CVE-2016-6723: A denial of service vulnerability in Proxy Auto Config in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1...

Security readout for executives and security teams

This Android flaw can let a remote attacker crash or reboot affected devices by abusing Proxy Auto Config handling. Google rated it Moderate because the vulnerable path depends on an uncommon device configuration, reducing broad business impact. The main risk is device availability loss, not data theft or code execution based on the supplied sources. Exposure is mainly older Android devices using proxy auto-configuration. Modern, patched Android fleets should have low exposure. Higher concern applies to legacy devices, unmanaged BYOD, embedded Android, or enterprise Wi-Fi profiles that require PAC settings. Handle through legacy Android hygiene rather than emergency response. Prioritize any business-critical or unmanaged devices still using PAC settings. There is no source-supported evidence of active exploitation, but unpatched devices could suffer avoidable outages. Mitigation focus: Update Android devices to the fixed version or November 1, 2016 security patch level or later.; Retire or isolate Android devices that cannot receive vendor security updates.; Disable PAC or proxy auto-configuration where it is not operationally required..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.