CVE-2015-6639

This vulnerability is a weakness inside a security component used by Android for protected media (Widevine). A malicious app can try to take advantage of that component to get more control over the phone than it normally should—like slipping past a locked door by exploiting a broken lock in the building’s security system.

This matters if your business uses Android devices running Android 5.x versions older than 5.1.1 LMY49F or Android 6.0 versions older than 2016-01-01. It’s relevant because attackers can use a crafted app to trigger the issue.

Reachability gate: it’s primarily a risk when a vulnerable device can run the attacker’s crafted application (for example, by installing/allowing it via normal app installation pathways).

Public exploits are available, and the vulnerability can lead to privilege escalation, so treat this as an active practical risk for any device that’s still on the affected Android versions. While this report doesn’t indicate it’s a confirmed, widely deployed KEV item, the combination of a usable exploit and rising attention makes it urgent for businesses with older Android devices.

1. Inventory and version check

• For each business Android phone/tablet, record:
  • Android version (5.x/6.0) and the build/version string if available.
  • Whether it can be updated (carrier/OEM updates).

2. Determine exposure

• Consider the device potentially affected if:
  • Android 5.x is older than 5.1.1 LMY49F, OR
  • Android 6.0 is older than 2016-01-01.

3. Upgrade to the fixed software

• Update affected devices to at least:
  • Android 5.1.1 LMY49F or newer, OR
  • Android 6.0 2015-01-01 or newer.
• After updating, re-check the device’s “About phone/tablet” screen to confirm the build/version changed.
• The vendor guidance points to the Android Security Bulletin dated 2016-01-01.

4. If you cannot update

• Reduce the likelihood of being targeted by crafted-app delivery:
  • Do not install apps from unknown sources.
  • Remove apps you didn’t install or don’t recognize.
• This does not “fix” the vulnerability, but it reduces exposure by limiting the attacker’s ability to get the crafted app onto the device.

5. What to monitor

• Look for signs consistent with a compromised or misbehaving device after installing new apps:
  • unexpected app permission changes,
  • repeated prompts for access/permissions,
  • unexplained crashes, battery drain, or unusual network behavior.

6. Timing

• Since public exploit code exists, prioritize updating any devices that match the affected Android version ranges first.

CVE-2015-6639 is a privilege escalation issue (CWE-264) involving the Widevine QSEE TrustZone application in Android. The reported mechanism is that a crafted application can leverage QSEECOM access to gain elevated privileges.

Exposure notes from the findings:

• Public exploitation: weaponization details indicate public exploit availability (2 known).
• KEV status: not listed in CISA KEV.
• Patch guidance: fixed by upgrading to Android 5.1.1 LMY49F and Android 6.0 2015-01-01 (or newer), referenced in the Android security bulletin dated 2016-01-01.

Severity/exploit maturity:

• The finding set supports a practical risk because working public exploits exist. Exact in-the-wild prevalence is not confirmed by KEV/news in the provided findings.