CVE-2016-1155: Google Android

Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days.

HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.

Affected products

• Google Android: version 2.2 only; version 2.2.1 only; version 2.2.2 only; version 2.2.3 only; version 2.3 only; version 2.3.1 only; …

Published 2017-04-13. Last modified 2026-06-17.