CVE-2018-9493

In the content provider of the download manager, there is a possible SQL injection due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111085900

• CWE-89

• http://www.securityfocus.com/bid/105484Third Party Advisory, VDB Entry
• https://android.googlesource.com/platform/frameworks/base/+/462aaeaa616e0bb1342e8ef7b472acc0cbc93deb%2C
• https://android.googlesource.com/platform/frameworks/base/+/ebc250d16c747f4161167b5ff58b3aea88b37acfPatch, Third Party Advisory
• https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/e7364907439578ce5334bce20bb03fef2e88b107%2C
• https://source.android.com/security/bulletin/2018-10-01%2C
• http://www.securityfocus.com/bid/105484Third Party Advisory, VDB Entry
• https://android.googlesource.com/platform/frameworks/base/+/462aaeaa616e0bb1342e8ef7b472acc0cbc93deb%2C
• https://android.googlesource.com/platform/frameworks/base/+/ebc250d16c747f4161167b5ff58b3aea88b37acfPatch, Third Party Advisory
• https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/e7364907439578ce5334bce20bb03fef2e88b107%2C
• https://source.android.com/security/bulletin/2018-10-01%2C

Published

Oct 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9487In setVpnForcedLocked of Vpn.java, there is a possible block…5.5
• CVE-2018-9488In the SELinux permissions of crash_dump.te, there is a perm…
• CVE-2018-9489When wifi is switched, function sendNetworkStateChangeBroadc…
• CVE-2018-9490In CollectValuesOrEntriesImpl of elements.cc, there is possi…
• CVE-2018-9491In AMediaCodecCryptoInfo_new of NdkMediaCodec.cpp, there is …
• CVE-2018-9492In checkGrantUriPermissionLocked of ActivityManagerService.j…
• CVE-2018-9496In ixheaacd_real_synth_fft_p3 of ixheaacd_esbr_fft.c there i…
• CVE-2018-9497In impeg2_fmt_conv_yuv420p_to_yuv420sp_uv_av8 of impeg2_form…
• CVE-2018-9498In SkSampler::Fill of SkSampler.cpp, there is a possible out…
• CVE-2018-9499In readVector of iCrypto.cpp, there is a possible invalid re…
• CVE-2018-9501In the SetupWizard, there is a possible Factory Reset Protec…
• CVE-2018-9502In rfc_process_mx_message of rfc_ts_frames.cc, there is a po…