Description
AndroidManifest.xml in Android before 5.0.0 does not require the SEND_SMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for old messages, via a crafted application that broadcasts an intent with the com.android.mms.transaction.MESSAGE_SENT action, aka Bug 17671795.
Exploits (1)
References (6)
Scores
EPSS
0.0006
EPSS Percentile
18.8%
Details
CWE
CWE-264
Status
published
Products (43)
google/android
1.0
google/android
1.1
google/android
1.5
google/android
1.6
google/android
2.0
google/android
2.0.1
google/android
2.1
google/android
2.2 (2 CPE variants)
google/android
2.2.1
google/android
2.2.2
... and 33 more
Published
Dec 15, 2014
Tracked Since
Feb 18, 2026