CVE-2016-6723 in Android
Summary
by MITRE
A denial of service vulnerability in Proxy Auto Config in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Moderate because it requires an uncommon device configuration. Android ID: A-30100884.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2025
The vulnerability identified as CVE-2016-6723 represents a significant denial of service flaw within the Proxy Auto Config (PAC) functionality of various Android versions. This issue affects Android 4.x systems prior to 4.4.4, Android 5.0.x before 5.0.2, Android 5.1.x before 5.1.1, Android 6.x before the November 2016 security update, and Android 7.0 before the same November 2016 patch. The vulnerability stems from inadequate input validation and processing within the PAC file handling mechanism, which is responsible for automatically configuring proxy settings for network traffic. When a maliciously crafted PAC file is processed by the affected Android versions, it triggers a condition that causes the device to become unresponsive or restart unexpectedly.
The technical implementation of this vulnerability involves the manipulation of Proxy Auto Config files that are commonly used in enterprise environments and corporate networks to automate proxy configuration. These PAC files contain javascript code that determines which proxy server to use for different URLs. The flaw occurs when the Android system processes these files without proper bounds checking or recursive call limiting, allowing an attacker to craft a PAC file with maliciously constructed javascript that causes infinite loops or excessive resource consumption. This behavior maps to CWE-121, heap-based buffer overflow, and CWE-674, uncontrolled recursion, as the system fails to properly validate the complexity and structure of the PAC file contents. The vulnerability operates at the system level within the Android network stack, specifically affecting the WebView component and proxy configuration handlers that are part of the operating system's core networking functionality.
The operational impact of CVE-2016-6723 extends beyond simple device disruption, as it can be leveraged in targeted attacks against specific Android devices in corporate environments where PAC files are commonly deployed. Attackers can exploit this vulnerability through various delivery mechanisms including malicious websites, email attachments, or compromised network proxy servers that distribute the crafted PAC files. The fact that this vulnerability requires an uncommon device configuration for exploitation means that it is not easily triggered through casual browsing or normal usage patterns, but rather requires specific network conditions or user interactions with malicious proxy configurations. This characteristic aligns with ATT&CK technique T1190, exploitation of remote services, and T1059, command and scripting interpreter, as attackers must craft specific javascript code that can be executed within the Android system's proxy processing environment. The vulnerability can lead to persistent device unavailability, which in enterprise settings could disrupt business operations and require manual device resets or reconfigurations.
Mitigation strategies for CVE-2016-6723 focus primarily on applying the relevant Android security patches released by Google in their November 2016 updates. Organizations should immediately upgrade all affected Android devices to versions that contain the patched Proxy Auto Config handling mechanisms. System administrators should also implement network-level controls to restrict access to potentially malicious PAC files and monitor proxy configuration changes on enterprise devices. Additional defensive measures include configuring network proxy settings to use trusted and verified PAC file sources only, implementing web content filtering solutions that can detect and block suspicious javascript patterns, and establishing device management policies that prevent automatic PAC file downloads from untrusted sources. The vulnerability's classification as Moderate severity indicates that while it requires specific conditions for exploitation, the potential for disruption makes it a critical concern for enterprise security teams. Security professionals should also consider implementing network segmentation and monitoring to detect unusual proxy configuration activities that might indicate exploitation attempts. Organizations with devices running affected Android versions should prioritize patch management processes and conduct regular security assessments to ensure complete remediation across their mobile device fleets.