CVE-2013-4787: Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications,...

Security readout for executives and security teams

CVE-2013-4787 is the Android “Master Key” flaw. A malicious APK could be altered without breaking its apparent signature, letting an attacker hide changed code inside an app that appears trusted. The main business risk is legacy Android devices installing tampered applications. Exposure is limited to Android 1.6 Donut through 4.2 Jelly Bean devices, especially unmanaged, sideloading-enabled, or unsupported devices that can install APKs from untrusted sources. Prioritize if the organization still operates legacy Android devices. Modern Android fleets are unlikely to be affected, but unsupported field devices, kiosks, or embedded Android systems may carry meaningful malware risk. Mitigation focus: Inventory Android devices and identify versions 1.6 through 4.2.; Apply OEM or vendor firmware updates that include Google’s fix.; Retire or isolate devices that cannot receive the fix..

Prepared

Jun 15, 2026, 01:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.