Read the docs
TI-2016-05636 Aliases CVE-2016-6585GHSA-fpr4-m35f-p9w5

Improper input validation in Symantec Norton Mobile Security for Android

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A Denial of Service vulnerability exists in Symantec Norton Mobile Security for Android prior to 3.16, which could let a remote malicious user conduct a man-in-the-middle attack via specially crafted JavaScript.

Why it matters now

EPSS 0.01389 72nd percentileScored 2026-11-07
Fix Fixed Norton Mobile Security for Android (Symantec): 3.16

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecNorton Mobile Security for Androidbefore 3.163.16Patch availableCNA
  • Norton Mobile Security for Android VendorSymantec Affected before 3.16 Fixed in 3.16 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:norton_mobile_security:*:*:*:*:*:android:*:*before 3.16VulnerableSymantec
  • cpe:2.3:a:symantec:norton_mobile_security:*:*:*:*:*:android:*:* Versions before 3.16 Vulnerable ·Symantec

Remediation

  • Fix · CNA Norton Mobile Security for Android (Symantec) Fixed in 3.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6585
  2. 2026-10-03 Alias added: GHSA-fpr4-m35f-p9w5

References

Advisory 1

  • TI-2016-05638 Information disclosure in Symantec Norton Mobile Security for Android CVSS 3.1MEDIUM 5.5
  • TI-2016-05637 Improper input validation in Symantec Norton Mobile Security for Android CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences