Security readout for executives and security teams
Plain-English summary
CVE-2013-7202 is an old PayPal for Android issue affecting version 5.3 and earlier. A remote attacker could make the app execute arbitrary JavaScript through its WebHybridClient component. The bundle does not show active exploitation or a CVSS score, but the described impact is serious for unmanaged legacy Android devices.
Executive priority
Treat as a targeted legacy mobile exposure issue. It is not KEV-listed in the supplied data, but arbitrary JavaScript execution in a payment app justifies prompt inventory and removal of outdated versions.
Technical view
The CVE describes a WebHybridClient weakness in PayPal 5.3 and earlier for Android that allows remote arbitrary JavaScript execution. The supplied data does not include CWE, CVSS, affected CPEs, exploit telemetry, or vendor remediation details beyond the affected version boundary.
Likely exposure
Exposure is most likely on legacy Android devices that still have PayPal for Android 5.3 or earlier installed. Organizations with managed mobile fleets, BYOD access, or archived test devices should verify app versions rather than assume the issue is gone.
Exploitation context
The source bundle includes public vulnerability references, including an MWR advisory and IBM X-Force entry. It does not include KEV listing, confirmed exploitation in the wild, or safe details on attack preconditions.
Researcher notes
Evidence is sparse: no CVSS, CWE, CPE list, or exploit status is provided. The useful technical anchor is the vulnerable WebHybridClient class in PayPal for Android 5.3 and earlier, plus the public MWR and IBM references.
Mitigation direction
- Identify Android devices with PayPal app version 5.3 or earlier.
- Update PayPal for Android through official vendor channels where available.
- Remove unsupported legacy PayPal app versions from managed devices.
- Restrict access from unmanaged or outdated mobile devices where feasible.
- Check PayPal/vendor guidance for any specific remediation details.
Validation and detection
- Query MDM or endpoint inventory for installed PayPal Android versions.
- Confirm no managed device runs PayPal version 5.3 or earlier.
- Review BYOD policy coverage for outdated financial apps.
- Document any remaining unsupported devices and compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2013-7202 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- paypal-android-cve20147202-code-exec(92099)CVE reference · vdb-entry, x_refsource_XF
- https://labs.mwrinfosecurity.com/advisories/paypal-remote-code-execution/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.