CVE-2017-0420: An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass o...

Security readout for executives and security teams

CVE-2017-0420 is an Android AOSP Mail information disclosure issue. A malicious app already on the device could bypass normal app data isolation and read data it should not access. The issue was rated High in the source description, but active exploitation is not reported in the provided sources. Exposure is most likely on legacy Android devices in the listed versions, especially where AOSP Mail is present and users can install local applications. Modern patched or upgraded Android fleets are less likely exposed, but device patch state must be verified. Prioritize if legacy Android devices remain in production, handle sensitive email or business data, or allow unmanaged app installation. For fully updated fleets, urgency is lower but should be documented as closed through patch or retirement evidence. Mitigation focus: Apply the relevant Google or OEM Android security update for this bulletin.; Upgrade or retire devices running the affected Android versions.; Check vendor guidance for device-specific fixed builds and patch levels..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.