This thesis attempts to explain the SCAP compliance of a preliminary vulnerability scanner which is in the form of an OVAL interpreter (and thus, SCAP compliant) , which scans for vulnerabilities reported because of the telephony feature in android, in the year 2016 as reported in the national vulnerability database (NVD). The implementation of the scanner is achieved by attempting to write an OVAL definition file, which when evaluated against a system characteristics file , produces an OVAL results file. The result file thus generated is in a standard form , which can be understood and interpreted by other SCAP compliant scanners as well, thus ensuring interoperability and standardization.