CVE-2017-13158: An information disclosure vulnerability in the Android system (activitymanagerservice).

Security readout for executives and security teams

CVE-2017-13158 is an Android information disclosure issue in ActivityManagerService. The public bundle identifies affected Android versions 5.1.1 through 8.0, but does not provide CVSS, CWE, prerequisites, or impact detail. Treat it as a legacy Android patch-status concern, especially for fleets with older or unsupported devices. Exposure is most likely on legacy Android devices running the listed versions without the relevant vendor security update. Managed enterprise phones, embedded Android devices, kiosks, and BYOD devices should be checked for Android version and security patch level. Set priority based on fleet exposure rather than exploit hype. If affected Android versions remain in production, this should be handled in legacy-device remediation and mobile risk reduction work. If all devices are patched or unsupported versions are absent, urgency is lower. Mitigation focus: Check Google and OEM guidance for the December 2017 Android bulletin fix status.; Update affected Android devices to a vendor-supported security patch level.; Retire or isolate devices that cannot receive vendor security updates..

Prepared

Jun 12, 2026, 19:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.