July 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 19 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r10 adds the fix for 6 CVEs: CVE-2024-31331, CVE-2024-31332, CVE-2024-31339, CVE-2024-34720, CVE-2024-34721, CVE-2024-34723.

Announced, with no public code

None this month.

Public before it was announced

None this month.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

No security tag this month.

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2024-31331 · platform/frameworks/base
  PackageManagerService.setMimeGroup now sends an ACTION_PACKAGE_CHANGED broadcast for the package, once per user where it is installed and with dontKillApp=true. It does this whenever mComponentResolver.updateMimeGroup reports a change, in addition to clearing the package's preferred activities.
• CVE-2024-31332 · platform/packages/apps/Settings
  Settings now checks the DISALLOW_ADD_WIFI_CONFIG user restriction in WifiDppConfiguratorActivity (onCreate and handleIntent) and AddNetworkFragment (onCreate), and finishes the activity when the restriction is set, so a restricted user can no longer use these UI entry points to add Wi-Fi configurations.
• CVE-2024-31339 · platform/packages/modules/StatsD
  MultiConditionTrigger no longer runs its trigger callback on a detached std::thread; the thread becomes a class member joined in the destructor, and StatsService gains a condition-variable based early-termination request so the delayed onStatsdInitCompleted handler exits promptly on shutdown, termination, destruction or StatsCompanionService death.
• CVE-2024-34720 · platform/frameworks/base
  Adds a peer-UID check (must be Process.SYSTEM_UID) when a Zygote connection is created in Java, and reworks the native nativeForkRepeatedly loop so that newly accepted connections are UID-checked immediately and dropped on mismatch instead of being handed, unchecked, back to the Java command handler.
• CVE-2024-34721 · platform/packages/providers/MediaProvider
  Adds an assertFileColumnsConsistent(match, uri, values) call in MediaProvider.java right after FileUtils.computeDataFromValues(). This covers the case where DATA is generated from values such as RELATIVE_PATH and DISPLAY_NAME, so files can no longer be inserted into another user's storage volume.
• CVE-2024-34723 · platform/frameworks/base
  ParcelableListBinder now takes the expected element Class and only adds deserialized Parcelables that are assignable to it, and MediaSessionRecord.getBinderForSetQueue passes QueueItem.class, so non-QueueItem Parcelable objects are no longer accepted into the media session queue list.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).