CVE-2015-9194

CVE-2015-9194 describes an information exposure vulnerability in Android devices utilizing various Qualcomm Snapdragon Mobile platforms. Specifically, statically allocated memory during module loading at TZ Startup was not properly zeroed, allowing modules to access residual data from previous applications. This vulnerability affects a wide range of Snapdragon chipsets, including the SD 210/212/205, 400, 425, 427, 430, 435, 450, 617, 625, 650/52, 800, 845, and Snapdragon_High_Med_2016, on Android versions before the 2018-04-05 security patch level. Rated with a CVSS score of 7.5 (High), this vulnerability is network-exploitable with low attack complexity and no user interaction required, leading to a high potential for confidential information exposure. There is no impact on integrity or availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. While the vulnerability has received minimal community discussion, with only one mention, it is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.