CVE-2017-13236: In the KeyStore service, there is a permissions bypass that allows access to protected resources.

Security readout for executives and security teams

CVE-2017-13236 is an Android KeyStore permissions bypass affecting Android 8.0 and 8.1. A local attacker could gain system-level execution privileges without user interaction. The source bundle does not provide CVSS details, but the privilege level makes this important for managed Android fleets. Exposure is most likely on Android 8.0 or 8.1 devices that have not received the relevant February 2018 Android security fixes or later OEM updates. Modern devices running newer Android versions or current patch levels are less likely to be exposed based on the provided affected-version data. Prioritize remediation for any business-managed Android 8.0 or 8.1 devices, especially those handling sensitive data. The issue is local, but successful exploitation could elevate attacker privileges substantially. Unsupported devices should be treated as a governance and lifecycle risk. Mitigation focus: Prioritize updating Android 8.0 and 8.1 devices to vendor-supported patched builds.; Check the Android February 2018 security bulletin and OEM advisories for applicable fixes.; Retire or isolate devices that cannot receive relevant security updates..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.