CVE-2016-1155

Critical

Published: 13/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The HTTP header injection vulnerability in the URLConnection class in Android OS from version 2.2 to 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.

Risk Assessment

Attackers can exploit this vulnerability to take control of user sessions or steal data, posing a serious threat to the security of mobile applications.

Recommendation

It is recommended to update the Android OS to the latest version to mitigate this vulnerability and to monitor applications for unauthorized activities.

Original NVD description (English source)

HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.