CVE-2009-2348: Android 1.5 CRBxx allows local users to bypass the (1) Manifest.permission.CAMERA (aka android.permission.C...

Security readout for executives and security teams

This old Android flaw allowed an installed local app to use the camera or microphone without first declaring the normal CAMERA or RECORD_AUDIO permissions. The business impact is privacy exposure on affected Android 1.5 CRBxx devices, not a remote server compromise. Exposure is most plausible in legacy Android 1.5 CRBxx devices or embedded products derived from that code. Current enterprise mobile fleets are unlikely to run this version, but old lab devices, kiosks, or archived embedded Android builds should be checked. Prioritize this only if the organization still operates legacy Android 1.5-era devices or embedded derivatives. For modern mobile fleets, the main action is confirming absence rather than launching an emergency response. Mitigation focus: Inventory Android 1.5 CRBxx or derivative devices.; Retire or update affected legacy Android builds where possible.; Check vendor guidance for fixes tied to the cited Android commits..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.