CVE-2013-6272: The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4....

Security readout for executives and security teams

This Android flaw lets a malicious app abuse phone notification handling to place calls, send carrier control codes, or hang up calls without the intended phone-call permission. The business risk is mainly legacy Android devices that can still install untrusted apps and have active cellular service. Exposure is most likely on unmanaged or legacy Android 4.1.1-4.4.2 devices with cellular capability. Modern managed fleets are less likely exposed if they have retired those versions or prevent installation of untrusted applications. Prioritize if the organization still operates old Android handsets with active SIMs. For fully modernized fleets, this is mainly a legacy asset hygiene issue, but any remaining exposed devices can create billing, fraud, and operational disruption risk. Mitigation focus: Inventory Android devices and identify any versions from 4.1.1 through 4.4.2.; Check Android or device-vendor guidance for confirmed fixed builds or replacement direction.; Retire or isolate unsupported affected devices from business use..

Prepared

Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.