Google Android CVE-2026-0016

Exploitation requires physical or shell-level local access to the Android device under a low-privileged user account (confirmed by PR:L in the CVSS vector). The device must be running Android 16 or Android 16-QPR2; other Android versions are not listed as affected. The vulnerable code path is reached through the Credential Manager service's provider removal logic - no additional privileges, special app permissions, or user interaction from a victim are required (UI:N per CVSS). Exploitation is strictly bounded to the local device (AV:L), ruling out any remote attack surface. Impact is limited to confidentiality only - specifically, reading cross-user credential provider settings - with no ability to write data or affect availability (I:N/A:N). Single-user devices have negligible practical exposure; multi-user configurations (enterprise shared devices, Android guest/secondary user mode) represent the realistic risk environment.

The overall risk signal is low. CVSS 3.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates strictly local exploitation requiring a low-privileged account, with only limited confidentiality impact and no integrity or availability consequences. Scope is Unchanged (S:U), so the attacker cannot pivot to higher-privilege contexts through this vulnerability alone. EPSS data is not provided in available intelligence, so exploitation probability cannot be quantitatively assessed. The vulnerability is absent from the CISA KEV catalog and no proof-of-concept has been identified, both of which depress real-world urgency. The most meaningful risk context is multi-user Android deployments - shared enterprise tablets or family-mode devices - where cross-user credential provider configuration leakage could expose which password managers or passkey services are registered for other accounts. For single-user consumer devices, practical risk is marginal. There are no conflicting signals between CVSS and the description: both consistently indicate local, low-privilege access.

A low-privileged secondary user account on a shared Android 16 corporate tablet triggers the updateProvidersWhenServiceRemoved code path within Credential Manager - for example, by installing and then removing a credential provider app - causing the permission check to be bypassed and allowing the attacker to read credential provider settings configured for other user profiles on the same device. This could reveal which password manager or passkey service another user has registered, potentially informing further targeted attacks against those services. No public proof-of-concept code exists at time of analysis.