CVE-2017-13240: A information disclosure vulnerability in the Android framework (crypto framework).

Security readout for executives and security teams

This is an Android information disclosure issue in framework crypto components on Android 8.0 and 8.1. The public sources do not say what data could be exposed, how easily, or whether user interaction is required. Treat it as a legacy mobile fleet hygiene issue if affected devices remain in use. Exposure is limited to Android 8.0 or 8.1 devices that did not receive the relevant February 2018-era vendor security update. Modern managed fleets are unlikely to be exposed unless old devices, embedded Android builds, or unsupported handsets remain active. Prioritize this if the organization still allows Android 8.0 or 8.1 devices to access corporate data. If mobile fleet controls enforce supported OS versions and current patches, business urgency is low but should be documented. Mitigation focus: Inventory Android 8.0 and 8.1 devices still in production.; Check vendor security bulletins for CVE-2017-13240 coverage.; Apply available Android or OEM security updates for affected devices..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.