CVE-2016-2422: Google Android

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA certificate in an unrelated CA role, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324357.

Affected products

• Google Android: version 4.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; version 4.1 only; …

Published 2016-04-18. Last modified 2026-06-17.