CVE-2013-4787
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for...
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
Exploit likelihood
What each source reports
NVD Score used
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
- Record
CVE-2013-4787- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
- Record
CVE-2013-4787- Updated
- 2026-11-02
EUVDEUVD-2013-4633 No score
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
- Record
EUVD-2013-4633- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jvm8-c647-56v7 No score
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for...
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
- Record
GHSA-jvm8-c647-56v7- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Google Android - 'APK' code Remote Security Bypass | 2013-07-03 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4787 is a high vulnerability (CVSS 9.3) in Google Android, published July 9, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.5%, the 96th percentile. No source names a fixed version.
References
securityfocus.com/bid/60952
jira.cyanogenmod.org/browse/CYAN-1602
plus.google.com/113331808607528811927/posts/GxDA6111vYy
zdnet.com/google-releases-fix-to-oems-for-blue-security-android-security-hole-7000017782
bluebox.com/corporate-blog/bluebox-uncovers-android-master-key
osvdb.org/94773
review.cyanogenmod.org
nvd.nist.gov/vuln/detail/CVE-2013-4787
github.com/advisories/GHSA-jvm8-c647-56v7