PatchSiren cyber security CVE debrief
CVE-2017-0410 Google CVE debrief
CVE-2017-0410 is a high-severity Android Framework vulnerability that can let a local malicious application execute arbitrary code inside a privileged process. The issue was publicly disclosed with the Android security bulletin dated 2017-02-08 and affects multiple Android release lines, including 5.0.2 through 7.1.1. For defenders, this is primarily a patch-and-coverage problem: if devices remain on affected builds, a malicious app may be able to gain elevated capabilities that are normally unavailable to third-party applications.
- Vendor
- Product
- CVE-2017-0410
- CVSS
- HIGH 7.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-08
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-08
- Advisory updated
- 2026-05-13
Who should care
Android device owners and fleet operators, mobile security teams, OEM/update managers, and app-allowlist/MDM administrators should care most. The risk is highest for environments that support user-installed apps on devices running affected Android versions.
Technical summary
NVD describes the flaw as an elevation-of-privilege issue in Android Framework APIs that could allow a local malicious application to execute arbitrary code in the context of a privileged process. NVD assigns CVSS 3.0 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and lists CWE-190 as the primary weakness. The affected versions in the supplied corpus are Android 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, and 7.1.1.
Defensive priority
High. The attack requires local access and user interaction, but the impact is privileged code execution on affected Android builds, which warrants prompt patching and fleet verification.
Recommended defensive actions
- Apply the Android security bulletin updates referenced for this issue to all affected devices as soon as vendor builds are available.
- Inventory Android devices and confirm none remain on the affected versions listed in the CVE record (5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1).
- Use MDM, app-allowlisting, or similar controls to reduce the chance of untrusted application installation on exposed devices.
- Prioritize remediation for devices that handle sensitive data or have elevated enterprise access.
- Retire, isolate, or closely manage devices that cannot receive security updates.
Evidence notes
Timing context: the CVE was published on 2017-02-08 and the supplied NVD record was modified on 2026-05-13; the modification date is not the issue date. The supplied official references include the Android security bulletin (source.android.com/security/bulletin/2017-02-01.html), and the NVD record enumerates the affected Android versions and CVSS/CWE metadata used in this debrief.
Official resources
Publicly disclosed in the Android security bulletin and recorded by CVE/NVD on 2017-02-08; the NVD entry was later modified on 2026-05-13.