CVE-2016-3889

Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism by accessing (1) an external tile from a system application, (2) the help feature, or (3) the Settings application during a pre-setup stage, aka internal bug 29194585.

• CWE-264

• http://source.android.com/security/bulletin/2016-09-01.htmlVendor Advisory
• http://www.securityfocus.com/bid/92854
• http://www.securitytracker.com/id/1036763
• https://android.googlesource.com/platform/frameworks/base/+/e206f02d46ae5e38c74d138b51f6e1637e261abeIssue Tracking, Patch
• https://android.googlesource.com/platform/packages/apps/Settings/+/bd5d5176c74021e8cf4970f93f273ba3023c3d72Issue Tracking, Patch
• http://source.android.com/security/bulletin/2016-09-01.htmlVendor Advisory
• http://www.securityfocus.com/bid/92854
• http://www.securitytracker.com/id/1036763
• https://android.googlesource.com/platform/frameworks/base/+/e206f02d46ae5e38c74d138b51f6e1637e261abeIssue Tracking, Patch
• https://android.googlesource.com/platform/packages/apps/Settings/+/bd5d5176c74021e8cf4970f93f273ba3023c3d72Issue Tracking, Patch

Published

Sep 11, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3883internal/telephony/SMSDispatcher.java in Telephony in Androi…
• CVE-2016-3884server/notification/NotificationManagerService.java in the N…
• CVE-2016-3885debuggerd/debuggerd.cpp in Debuggerd in Android 5.0.x before…
• CVE-2016-3886systemui/statusbar/phone/QuickStatusBarHeader.java in the Sy…
• CVE-2016-3887providers/settings/SettingsProvider.java in Android 7.0 befo…
• CVE-2016-3888internal/telephony/SMSDispatcher.java in Android 4.x before …
• CVE-2016-3890The Java Debug Wire Protocol (JDWP) implementation in adb/so…
• CVE-2016-3892The Qualcomm SPMI driver in Android before 2016-09-05 on Nex…
• CVE-2016-3893The wcdcal_hwdep_ioctl_shared function in sound/soc/codecs/w…
• CVE-2016-3894The Qualcomm DMA component in Android before 2016-09-05 on N…
• CVE-2016-3895Integer overflow in the Region::unflatten function in libs/u…
• CVE-2016-3896AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5…