CVE-2011-1149: Android before 2.3 does not properly restrict access to the system property space, which allows local appli...

Security readout for executives and security teams

CVE-2011-1149 is an old Android flaw affecting versions before 2.3. A local app could escape parts of Android's application sandbox and gain additional privileges by abusing access to the system property space. The issue matters mainly for legacy Android devices that still run unsupported software. Exposure is likely limited to Android devices running versions before 2.3, especially unmanaged, embedded, kiosk, lab, or legacy mobile assets that can install or run local applications. Prioritize if legacy Android devices remain in production or handle sensitive operations. For modern Android fleets, business urgency is low, but unmanaged embedded or kiosk devices should be checked. Mitigation focus: Inventory Android devices and identify any running versions before 2.3.; Upgrade affected devices to Android 2.3 or later where vendor firmware is available.; Retire or isolate devices that cannot be upgraded..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.