CVE-2016-3832
HighSummary
The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, allowing attackers to bypass an unspecified protection mechanism via a crafted application.
Risk Assessment
Organizations may be exposed to attacks that exploit this vulnerability to introduce malware, potentially leading to data loss or system security breaches.
Recommendation
It is recommended to update Android to the latest version to mitigate this vulnerability and to monitor applications installed on devices.
Other vulnerabilities in Android Framework
See all- CVE-2017-0667High
CVE-2017-0667 is a privilege escalation vulnerability in the Android framework. It affects versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0666High
CVE-2017-0666 is a privilege escalation vulnerability in the Android framework. It affects versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0665High
CVE-2017-0665 is a privilege escalation vulnerability in the Android framework. It affects versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0664High
CVE-2017-0664 is a privilege escalation vulnerability in the Android framework. It affects versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2025-32347High
In the onStart method of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent, which could lead to local escalation of privilege. User interaction is needed.
- CVE-2025-22438High
In the afterKeyEventLockedInterruptable method of InputDispatcher.cpp, there is a possible use after free, which could lead to local escalation of privilege. User interaction is not needed.
Original NVD description (English source)
The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, which allows attackers to bypass an unspecified protection mechanism via a crafted application, aka internal bug 28795098.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS