Back
CVE-2015-3860
packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of…
High7.2EPSS 0.37%
- Published
- Updated
- Reserved
- Assigned by
- google_android
Description
packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | High7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
- EPSS (exploitation in 30 days)
- 0.37% · top 68% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Weakness
Affected products
n/a
- affected n/a
References (4)
- [android-security-updates] 20150909 Nexus Security Bulletin (September 2015) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://code.google.com/p/android/issues/detail?id=178139 (opens in a new tab)x_refsource_CONFIRMx_transferred
- http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-bypass/ (opens in a new tab)x_refsource_MISCx_transferred
- https://android.googlesource.com/platform/frameworks/base/+/8fba7e6931245a17215e0e740e78b45f6b66d590 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2015-3860)Record last updated .