June 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 18 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r9 adds the fix for 16 CVEs: CVE-2024-31310, CVE-2024-31311, CVE-2024-31312, CVE-2024-31313, CVE-2024-31314, CVE-2024-31315, CVE-2024-31316, CVE-2024-31317, CVE-2024-31318, CVE-2024-31319, CVE-2024-31322, CVE-2024-31323, CVE-2024-31324, CVE-2024-31325, CVE-2024-31326, CVE-2024-31327.

Announced, with no public code

None this month.

Public before it was announced

None this month.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

No security tag this month.

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2024-31310 · platform/frameworks/base
  AutofillManagerServiceImpl.newServiceInfoLocked now uses PackageManager.queryIntentServicesAsUser to check that the component being set as the autofill service declares the AutofillService.SERVICE_INTERFACE intent filter, and throws SecurityException if it does not.
• CVE-2024-31311 · platform/packages/modules/StatsD
  Adds a bounds check in libstatssocket's increment_annotation_count() so that an annotation added after the AStatsEvent buffer has reached its maximum capacity no longer reads and writes the byte at event->buf[lastFieldPos] when lastFieldPos is at or beyond event->bufSize.
• CVE-2024-31312 · platform/frameworks/base
  Moves enforcement of the Settings.Secure.MEDIA_CONTROLS_LOCK_SCREEN user setting from the keyguard-only KeyguardMediaController into MediaHierarchyManager/MediaHost so that, when the setting is disabled, every media host hides the media carousel while the device is in the KEYGUARD or SHADE_LOCKED state.
• CVE-2024-31313 · platform/system/libfmq
  Adds underflow checks to MessageQueueBase::availableToReadBytes() and availableToWriteBytes() in system/libfmq, so that inconsistent read/write counters yield 0 (with an error log) instead of a wrapped size_t.
• CVE-2024-31314 · platform/frameworks/base
  Adds a per-package, time-windowed throttle in ShortcutPackage so that ShortcutService forwards at most REPORT_USAGE_BUFFER_SIZE (3) shortcut-usage reports per mSaveDelayMillis window to UsageStatsManagerInternal.reportShortcutUsage, instead of forwarding every reportShortcutUsed/pushDynamicShortcut call unconditionally.
• CVE-2024-31315 · platform/frameworks/base
  ManagedServices now checks that a managed service component (e.g. a NotificationListenerService) still declares the required bind permission before rebinding it, and removes approved component entries that lost the permission when their package changes.
• CVE-2024-31316 · platform/frameworks/base
  Adds a second checkKeyIntent() check of the result Bundle returned by the authenticator in two result-handling paths of AccountManagerService. The check runs after the Bundle has been modified (KEY_AUTHTOKEN removed) and rejects the response with ERROR_CODE_INVALID_RESPONSE if the intent fails it.
• CVE-2024-31317 · platform/frameworks/base
  Adds character validation in core/java/android/os/ZygoteProcess.java so that hidden API denylist exemption strings containing '\n', '\r' or '\u0000' are rejected (list cleared, nothing written) before reaching the zygote command socket, and process start arguments containing '\u0000' now throw ZygoteStartFailedEx alongside the existing newline and carriage return checks.
• CVE-2024-31318 · platform/frameworks/base
  The CompanionDeviceManagerService binder implementation no longer overrides onShellCommand and instead overrides handleShellCommand. The base Binder.onShellCommand, which per the commit message checks the caller's permissions, therefore runs before CompanionDeviceShellCommand is executed.
• CVE-2024-31319 · platform/frameworks/base
  Adds a URI read-permission check in NotificationManagerService.updateNotificationChannelFromPrivilegedListener so a privileged (CDM) NotificationListenerService can only set a new channel sound URI that its own UID is allowed to read.
• CVE-2024-31322 · platform/frameworks/base
  AccessibilityManagerService.updateServicesLocked now removes components that are no longer installed from the user's enabled accessibility services list and touch-exploration-granted list and persists both settings, so a service that disappears after a service update does not stay enabled.
• CVE-2024-31323 · platform/packages/modules/HealthFitness
  Adds the HIDE_OVERLAY_WINDOWS permission to the Health Connect controller APK manifest and sets SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS in onCreate of seven Health Connect activities so non-system apps cannot show overlay windows on the Health Connect UI.
• CVE-2024-31324 · platform/frameworks/base
  WindowState.hide() now decides whether to defer the visibility change based on whether an exit animation was actually applied to the window itself (return value of mWinAnimator.applyAnimationLocked), instead of checking isAnimating(TRANSITION | PARENTS), so a window with no hide animation is committed invisible immediately even when its parent container is animating.
• CVE-2024-31325 · platform/frameworks/base
  SystemUI now constructs each ExpandableNotificationRow's NotificationInlineImageResolver with a Context bound to the notification's own user (via createContextAsUser when it differs from SystemUI's user) instead of SystemUI's application context, so inline message/conversation image Uris are resolved with the notification's user id.
• CVE-2024-31326 · platform/frameworks/base
  Adds a one-time, persisted "post upgrade" migration step in DevicePolicyManagerService that pushes screen-capture-disabled, lock task, and legacy user restriction policies held by device/profile owner ActiveAdmins into the DevicePolicyEngine, because the initial Android T to U migration did not carry them over correctly.
• CVE-2024-31327 · platform/system/libfmq
  Adds consistency checks to MessageQueueBase::availableToReadBytes() and availableToWriteBytes() in libfmq so that inconsistent read/write pointer values (readPtr > writePtr, or available > queue size) yield 0 with an error log instead of an unsigned underflow.
• CVE-2024-32896 · platform/frameworks/base
  RecoverySystemService.rebootRecoveryWithCommand() now destroys all KeyMint keys via the new AndroidKeyStoreMaintenance.deleteAllKeys() (IKeystoreMaintenance.deleteAllKeys) before rebooting to recovery when the command contains "--wipe_data", with a matching SELinux allow for system_server, so FBE-encrypted data becomes unrecoverable even if the recovery data wipe is interrupted or skipped.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).