CVE-2024-49734: Google Android

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a device has connected to through a VPN due to side channel information disclosure. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

• Google Android: version 14.0 only; version 15.0 only

Published 2025-01-21. Last modified 2026-06-17.