December 2024: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 8 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r15 adds the fix for 6 CVEs: CVE-2024-43097, CVE-2024-43762, CVE-2024-43764, CVE-2024-43767, CVE-2024-43768, CVE-2024-43769.

Announced, with no public code

None this month.

Public before it was announced

None this month.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

No security tag this month.

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2024-43097 · platform/external/skia
  In Skia's SkRegion.cpp, RunArray::resizeToAtLeast now computes the 50% growth headroom with SkSafeMath::addInt and clamps the new element count to SK_MaxS32 on overflow, instead of letting `count += count >> 1` overflow a signed int before it is passed to realloc and stored as fCount.
• CVE-2024-43762 · platform/frameworks/base
  Adds ServiceConnection.onNullBinding() overrides to three service connections in the app widget stack (RemoteViewsAdapter and two anonymous connections in AppWidgetServiceImpl), so that a service whose onBind() returns null gets unbound.
• CVE-2024-43764 · platform/frameworks/base
  SystemUI's ClipboardListener now checks KeyguardManager.isDeviceLocked() before showing the interactive clipboard overlay, falling back to the non-interactive "copied" toast when the device is locked.
• CVE-2024-43767 · platform/external/skia
  Adds a check in SkBlurMF.cpp prepare_to_draw_into_mask() so it returns false when SkMask::computeImageSize() returns 0 (the size overflow signal, per the commit title), so no SkMask image is allocated with that size.
• CVE-2024-43768 · platform/external/skia
  Adds an integer-overflow bounds check to Skia's zlib allocator callback skia_alloc_func in src/pdf/SkDeflate.cpp so that nullptr is returned when items * size would not fit in size_t, instead of passing a wrapped-around size to sk_calloc_throw.
• CVE-2024-43769 · platform/frameworks/base
  Reworks PackageManagerService.isPackageDeviceAdmin so the device management role holder (DMRH) counts as an admin only on users that are organization-managed. When the DMRH is a system package, it is treated as an admin on all users whenever any user is both managed and has it as role holder. Per the commit comment, this addresses 'uninstall updates' on an unmanaged user breaking management on other users.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).