CVE-2016-6586 Security feature bypass in Norton Mobile Security for Android
Attackers can bypass URL filtering in Norton Mobile Security for Android by injecting JavaScript to add arbitrary URLs to the whitelist.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6586?
CVE-2016-6586 is a low-severity vulnerability in Symantec Norton Mobile Security for Android, published on 8 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security bypass vulnerability exists in Symantec Norton Mobile Security for Android before 3.16, which could let a malicious user conduct a man-in-the-middle via specially crafted JavaScript to add arbitrary URLs to the URL whitelist.
Weakness: CWE-20
Which versions are affected by CVE-2016-6586?
It affects 1 product.
Products include Symantec Norton Mobile Security.
How do I fix CVE-2016-6586?
No fix has been published for CVE-2016-6586 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-6586 being exploited?
There is no known exploitation of CVE-2016-6586 in the wild and no public exploit code.
Other vulnerabilities in Symantec Norton Mobile Security for Android
Sources
Also known as GHSA-m7x5-4x88-qpg9.