CVE-2014-9899: drivers/usb/host/ehci-msm2.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices omi...

Security readout for executives and security teams

CVE-2014-9899 is an information disclosure flaw in a Qualcomm USB host driver used on Nexus 5 Android builds before the 2016-08-05 security update. A malicious app could cause sensitive information exposure. The public bundle does not show active exploitation or broad Android impact beyond the named Nexus 5 scope. Exposure appears limited to Nexus 5 devices running Android builds before the 2016-08-05 security level with the vulnerable Qualcomm component. The bundle does not identify other products or versions. Treat this as a legacy mobile exposure issue, not an enterprise-wide emergency based on the provided evidence. Prioritize confirming whether any Nexus 5 devices remain in use and removing or updating them if found. Mitigation focus: Update affected Nexus 5 devices to Android security level 2016-08-05 or later.; Retire or isolate Nexus 5 devices that cannot receive the relevant update.; Restrict installation of untrusted applications on any remaining affected devices..

Prepared

Jun 13, 2026, 14:00 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.