CVE-2014-8610: Google Android

Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days.

AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for old messages, via a crafted application that broadcasts an intent with the com.android.mms.transaction.MESSAGE_SENT action, aka Bug 17671795.

Affected products

• Google Android: up to and including 4.4.4; version 1.0 only; version 1.1 only; version 1.5 only; version 1.6 only; version 2.0 only; …

Published 2014-12-15. Last modified 2026-06-17.