CVE-2016-8475: An information disclosure vulnerability in the HTC input driver could enable a local malicious application...

Security readout for executives and security teams

CVE-2016-8475 is an Android information-disclosure issue in an HTC input driver. A local malicious app could access data beyond its permissions, but the source says exploitation first requires compromising a privileged process. That makes this more serious on unmanaged or already-compromised devices than as a standalone remote threat. Exposure is most likely limited to Android devices using Kernel-3.18 with the HTC input driver and missing the January 2017 Android security bulletin fixes. The provided evidence does not identify exact HTC device models, carrier builds, or downstream vendor patch status. Treat this as a legacy Android hygiene issue, not an emergency remote-compromise event. Prioritize if the organization still operates HTC or Kernel-3.18 Android devices, especially where devices handle sensitive data or lack strong app controls. Mitigation focus: Apply Android vendor updates covering the January 2017 security bulletin.; Retire or isolate devices that cannot receive relevant vendor firmware updates.; Use MDM controls to restrict untrusted app installation on legacy Android devices..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.