CVE-2016-5341: Google Android

Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days.

The GPS component in Android before 2016-12-05 allows man-in-the-middle attackers to cause a denial of service (GPS signal-acquisition delay) via an incorrect xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host, aka internal bug 31470303 and external bug 211602 (and AndroidID-7225554).

Affected products

• Google Android: up to and including 7.1.0

Published 2016-12-06. Last modified 2026-06-17.