Vulnerability record · CVE-2013-6271 · published 14 December 2013

CVE-2013-6271: Google android permissions and access controls vulnerability

Google · Android

Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invokes the updateUnlockMethodAndFinish method in the com.android.settings.ChooseLockGeneric class with the PASSWORD_QUALITY_UNSPECIFIED option.

8.8 CVSS 2.0 High EPSS 8.0% · top 5.4% CWE-264 · Permissions and access controls

8.8CVSS 2.0 base score

8.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:C/I:C/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Android Google

References

Link	Tags
http://seclists.org/fulldisclosure/2013/Nov/204	Exploit
http://www.securitytracker.com/id/1029410
http://www.theregister.co.uk/2013/12/10/android_has_lockbypass_bug/
https://cureblog.de/2013/11/cve-2013-6271-remove-device-locks-from-android-phone/	Exploit
http://seclists.org/fulldisclosure/2013/Nov/204	Exploit
http://www.securitytracker.com/id/1029410
http://www.theregister.co.uk/2013/12/10/android_has_lockbypass_bug/
https://cureblog.de/2013/11/cve-2013-6271-remove-device-locks-from-android-phone/	Exploit

Track CVE-2013-6271 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed15 Sep 2026 8.8CVE-2025-48543Android use-after-free allows Chrome sandbox escape to system_serverA use-after-free in multiple Android locations lets an attacker escape the Chrome sandbox and reach the Android system_server process. Because the fl…KEVEPSS 0.54%analysed4 Sep 2025 8.4CVE-2025-48595Android Framework integer overflow enables local code executionAn integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileg…KEVEPSS 1.7%analysed1 Jun 2026 7.8CVE-2025-48572Android Framework permissions bypass enables background activity launchMultiple locations in the Android Framework allow activities to be launched from the background because of a permissions bypass, a missing authentica…KEVEPSS 0.26%analysed8 Dec 2025 7.8CVE-2024-32896Android Pixel logic error allows local privilege escalationCVE-2024-32896 is a logic error in Android (CWE-670/CWE-783) that permits a local attacker to bypass intended restrictions and escalate privileges. I…KEVEPSS 3.0%analysed13 Jun 2024 7.8CVE-2024-29748Android Pixel logic error allows local privilege escalationCVE-2024-29748 is a logic error in Android code that permits bypassing a security check, leading to local escalation of privilege. It affects Google …KEVEPSS 0.67%analysed5 Apr 2024 7.8CVE-2023-35674Android WindowState logic error allows background activity launch and privilege escalationA logic error in onCreate of WindowState.java in the Android Framework lets a background activity be launched, enabling local escalation of privilege…KEVEPSS 2.6%analysed11 Sep 2023 7.8CVE-2023-20963Android WorkSource parcel mismatch local privilege escalationCVE-2023-20963 is a parcel mismatch in Android's WorkSource component that allows a local attacker to escalate privileges without additional executio…KEVEPSS 1.5%analysed24 Mar 2023

Source: NIST National Vulnerability Database (record CVE-2013-6271), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.