CVE-2022-1799: Incorrect signature verification on Google play-services-basement in Google Play SDK

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-29 · updated 2026-06-17
Weakness: CWE-501

Description

Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted by the SDK for devices that are non-GMS. We recommend upgrading the SDK past the 2022-05-03 release.

Affected products

Google LLC Play Services SDK: before 18.0.2 — fixed in 18.0.2

How to fix

Upgrade to a fixed version: Google LLC Play Services SDK 18.0.2. Check the vendor advisory for mitigations.

References

https://developers.google.com/android/guides/releases#may_03_2022
https://developers.google.com/android/guides/releases#may_03_2022

Get alerted when CVE-2022-1799 or the next vulnerability affects your stack