CVE-2014-8609
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the...
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.
Exploit likelihood
What each source reports
NVD Score used
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.
- Record
CVE-2014-8609- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.
- Record
CVE-2014-8609- Updated
- 2026-11-02
EUVDEUVD-2014-8446 No score
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.
- Record
EUVD-2014-8446- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m288-pv5h-3xf6 No score
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the...
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.
- Record
GHSA-m288-pv5h-3xf6- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | MazX0p/CVE-2014-8609-POC | 2021-07-17 |
| PoC in GitHub | locisvv/Vulnerable-CVE-2014-8609 | 2015-04-07 |
| PoC in GitHub | ratiros01/CVE-2014-8609-exploit | 2022-05-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8609 is a high vulnerability (CVSS 7.2) in Google Android, published December 15, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. No source names a fixed version.
References
packetstormsecurity.com/files/129281/Android-Settings-Pendingintent-Leak.html
xteam.baidu.com?p=158
seclists.org/fulldisclosure/2014/Nov/81
android.googlesource.com/platform/packages/apps/Settings/+/f5d3e74ecc2b973941d8adbe40c6b23094b5abb7
nvd.nist.gov/vuln/detail/CVE-2014-8609
github.com/advisories/GHSA-m288-pv5h-3xf6