Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android on Nexus phones lets malicious app gain extra rights

CVE-2016-3864 · published 10 years ago
Summary

Older versions of Android on Nexus 5, 5X, 6, 6P and Android One devices could let a specially crafted app obtain higher privileges than it should. This could let an attacker perform actions on the phone without the user’s consent. Update the device to the latest Android version released after September 5, 2016 to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
google android <= 7.0
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Original advisory text
The Qualcomm radio interface layer in Android before 2016-09-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka A...
The Qualcomm radio interface layer in Android before 2016-09-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28823714 and Qualcomm internal bug CR913117.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published11 Sep 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-3864 · NVD
Track software like this
Free during beta