CVE-2016-3889

CVE-2016-3889 describes a bypass vulnerability in Android's Factory Reset Protection (FRP) mechanism affecting versions 6.x and 7.0 prior to the September 2016 security updates. This flaw allows a physically proximate attacker to bypass FRP by interacting with specific system features during the device's pre-setup stage. The vulnerability carries a CVSSv3 score of 6.8 (Medium), indicating a high impact on confidentiality, integrity, and availability, with a physical attack vector and low attack complexity. An attacker requires physical access to the device to exploit this weakness. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE. It is not listed on the CISA KEV catalog.