CVE-2017-13159: An information disclosure vulnerability in the Android system (activitymanagerservice).

Security readout for executives and security teams

CVE-2017-13159 is an Android information disclosure flaw in the system ActivityManagerService. The sources identify affected Android versions from 5.1.1 through 8.0, but do not provide CVSS severity, CWE, attack requirements, or exposed data details. Business urgency depends on whether legacy Android devices remain unpatched. Most likely exposure is unmanaged or legacy Android devices still running affected versions without the December 2017 Android security bulletin fixes from their OEM or carrier. Modern fully patched devices are less likely exposed, but confirmation requires device patch-level validation. Prioritize as legacy mobile fleet risk rather than an emergency, unless affected unpatched devices handle sensitive data or access corporate systems. The absence of severity and exploitation evidence lowers confidence, but unsupported Android devices should not be trusted for sensitive workflows. Mitigation focus: Identify Android devices running affected versions.; Apply OEM or carrier firmware containing the December 2017 Android security fixes.; Retire unsupported Android devices that cannot receive vendor updates..

Prepared

Jun 12, 2026, 19:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.