Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2021-1048

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204573007References: Upstream kernel

CVSS 7.8 · HighBuzz score 58.8KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 58.8

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 13.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
13.0
4 sources across 2 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • Pwning the all Google phone with a non-Google bugGitHub Security Lab

    It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit that used this vulnerability to gain arbitrary kernel code execution and root on a Pixel 6 from an Android app.

    vendorgithub.blogJan 23, 2023, 3:05 PM
  • CISA adds 41 flaws to its Known Exploited Vulnerabilities CatalogSecurity Affairs

    US Critical Infrastructure Security Agency (CISA) adds 41 new vulnerabilities to its Known Exploited Vulnerabilities Catalog. The Cybersecurity & Infrastructure Security Agency (CISA) has added 41 flaws to its Known Exploited Vulnerabilities Catalog, including recently addressed issues in the Android kernel (CVE-2021-1048 and CVE-2021-0920) and Cisco IOS XR (CVE-2022-20821). The Cisco IOS XR flaw (CVE-2022-20821, CVSS score: […]

    newssecurityaffairs.comMay 25, 2022, 8:36 AM
  • Zero-day vulnerabilities in Chrome and Android exploited by commercial spywareMalwarebytes Labs

    The Google Threat Analysis Group (TAG) has revealedthat of the nine zero-day vulnerabilities affecting Chrome, Android, Apple and Microsoft that it…

    newswww.malwarebytes.comMay 23, 2022, 5:00 PM
  • Cytrox’s Predator spyware used zero-day exploits in 3 campaignsSecurity Affairs

    Google’s Threat Analysis Group (TAG) uncovered campaigns targeting Android users with five zero-day vulnerabilities. Google’s Threat Analysis Group (TAG) researchers discovered three campaigns, between August and October 2021, targeting Android users with five zero-day vulnerabilities. The attacks aimed at installing the surveillance spyware Predator, developed by the North Macedonian firm Cytrox. The five 0-day vulnerabilities […]

    newssecurityaffairs.comMay 23, 2022, 9:04 AM
  • Google fixes actively exploited Zero-Day Kernel flaw in AndroidSecurity Affairs

    Google’s Android November 2021 security updates address a zero-day vulnerability in the Kernel that is actively exploited in the wild. Google’s Android November 2021 security updates addressed 18 vulnerabilities in the framework and system components and 18 issues in the kernel and vendor components. One of these issues, tracked as CVE-2021-1048, is a use-after-free (UAF) vulnerability […]

    newssecurityaffairs.comNov 3, 2021, 6:31 AM
  • Google Patches Android Zero-Day Exploited in Targeted AttacksSecurityWeek

    Google on Monday announced the availability of the November 2021 security updates for Android and warned that one of the patched vulnerabilities has been exploited in attacks.

    newswww.securityweek.comNov 2, 2021, 12:47 PM
  • Google patches zero-day vulnerability, and others, in AndroidMalwarebytes Labs

    Google has issued security patches for the Android Operating System. In total, the patches address 39 vulnerabilities. There are indications that…

    newswww.malwarebytes.comNov 1, 2021, 5:00 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-15772

    Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escap…

    CVSS 8.3 · High
    2 mentions
  • CVE-2026-15113

    Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium…

    CVSS 9.6 · Critical
    2 mentions
  • CVE-2026-14064

    Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary…

    CVSS 7.5 · High
    4 mentions
  • CVE-2026-14005

    Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploi…

    CVSS 8.8 · High
    4 mentions
  • CVE-2026-13885

    Use after free in Skia in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium s…

    CVSS 8.8 · High
    4 mentions
  • CVE-2026-13870

    Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromiu…

    CVSS 8.8 · High
    4 mentions