CVE-2024-50302

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 6 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

2.78%

probability

This CVE has a 2.78% probability of being exploited in the next 30 days.

0% Top 86.3th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

HID core information leak

Attack Intelligence

CWE-664 · Improper Control of a Resource Through its Lifetime CWE-665 · Improper Initialization CWE-908 · Use of Uninitialized Resource

Google Project Zero

Discovered

Oct. 29, 2024

Patched

March 1, 2025

Reported by

Benoît Sevens of Google's Threat Analysis Group

Root Cause Analysis

???

Google's March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities

TheHackerNews

Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities

TheHackerNews

Google fixes Android zero-days exploited in attacks, 60 other flaws

BleepingComputer Apr 07, 2025

Google fixes Android zero-day exploited by Serbian authorities

BleepingComputer Mar 04, 2025

Serbian police used Cellebrite zero-day hack to unlock Android phones

BleepingComputer Feb 28, 2025

Critical Remote Code Execution Vulnerability Patched in Android

SecurityWeek May 05, 2026

Signal Intelligence

Confidenceⓘ

75%

EPSS 2.78%

Mentions 6

Last Seen May 05, 2026

CNA Information

Analyst Note

This CVE addresses a kernel memory disclosure vulnerability in HID report buffer handling with a MEDIUM CVSS score (5.5). Confirmation is supported by its presence in Google Project Zero's vulnerability tracking and multiple security publications, though it lacks CISA KEV listing and the available articles appear tangentially related rather than directly focused on this specific CVE.