Google Android are prone to an HTTP header-injection vulnerability because it fails to sufficiently sanitize user input.
A successful attack may allow attackers to insert a crafted HTTP header into an HTTP response that could cause a web page redirection to a possible malicious website; this may aid in launching further attacks.
Google Android 2.2 is vulnerable.
Information
Google Android 5.0.2
Google Android 5.0.1
Google Android 4.4.4
Google Android 4.4.3
Google Android 4.4.2
Google Android 4.4.1
Google Android 4.3.1
Google Android 4.2.2
Google Android 4.2.1
Google Android 4.1.2
Google Android 4.1.1
Google Android 4.0.4
Google Android 4.0.3
Google Android 4.0.2
Google Android 4.0.1
Google Android 3.2.6
Google Android 3.2.4
Google Android 3.2.2
Google Android 3.2.1
Google Android 2.3.6
Google Android 2.3.5
Google Android 2.2.3
Google Android 6.0
Google Android 5.1
Google Android 5.0
Google Android 4.6
Google Android 4.4W.2
Google Android 4.4W.1
Google Android 4.4W
Google Android 4.4_r1.1 tag
Google Android 4.4
Google Android 4.3
Google Android 4.2
Google Android 4.1.2_r1
Google Android 4.1
Google Android 4.0
Google Android 3.2
Google Android 3.1
Google Android 3.0
Google Android 2.3.4
Google Android 2.3.3
Google Android 2.3.2
Google Android 2.3.1
Google Android 2.3
Google Android 2.2.2
References: