CVE-2016-2420

CVE-2016-2420 is a privilege escalation vulnerability affecting Android 4.x before 4.4.4. Specifically, the rootdir/init.rc script fails to ensure the existence of the /data/tombstones directory for the Debuggerd component. This flaw allows a crafted application to gain elevated privileges on the affected Android devices. The vulnerability carries a CVSS v3 score of 7.8 (High), indicating a significant risk. It is a local attack vector requiring user interaction (e.g., installing a malicious app) with low attack complexity, potentially leading to high impacts on confidentiality, integrity, and availability. There is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low profile.