CVE-2015-8889

7.8 highEPSS 0.5%

High (7.8) in google android. EPSS 0.5% chance of exploitation in the next 30 days.

The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impact and attack vectors, aka Android internal bug 28822677 and Qualcomm internal bug CR804067.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2016-07-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

google:android

References

http://source.android.com/security/bulletin/2016-07-01.html
http://www.securityfocus.com/bid/91628
https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=fa774e023554427ee14d7a49181e9d4afbec035e
http://source.android.com/security/bulletin/2016-07-01.html
http://www.securityfocus.com/bid/91628

Check your stack JSON