EUVD-2026-37179
GHSA-7hvg-2m68-fmj3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local-only attack vector with low-privilege requirement confirmed; confidentiality-only partial impact with no integrity or availability loss matches a permission bypass yielding read access.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Permission bypass in Android's KeyMint component exposes locally accessible sensitive information to low-privileged users due to a logic error in authorization checks. Affecting Android devices (CPE: cpe:2.3:a:google:android:*), a local attacker holding only standard user privileges can read protected cryptographic or key-related data without requiring elevated execution rights or any user interaction. No public exploit exists at time of analysis, and EPSS probability sits at 0.07%, consistent with the SSVC assessment of no current exploitation.
Technical ContextAI
KeyMint (formerly Keymaster) is Android's Trusted Execution Environment (TEE)-backed keystore subsystem responsible for hardware-protected cryptographic key operations including key generation, storage, attestation, and usage authorization. CWE-862 (Missing Authorization) identifies the root cause as a logic error where the code path fails to enforce an expected permission or capability check before granting access to sensitive resources. Rather than a memory-safety flaw, this is a control-flow defect - the code reaches a state where it should reject a request but proceeds due to incorrect branching or missing gate logic. The affected CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:* covering all Android versions. The vulnerability was surfaced via Google's internal Pixel security team and disclosed in the June 2026 Pixel security bulletin.
RemediationAI
The primary fix is to apply the June 2026 Pixel security update, available via the official bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01. Exact patched build versions should be verified against that bulletin, as the input data does not enumerate a specific fixed version number. For enterprise Android deployments, prioritize patch delivery through MDM/EMM platforms (e.g., Android Enterprise zero-touch enrollment update policies). As a compensating control prior to patching, restricting sideloading and enforcing application allowlisting via policy reduces the surface of low-privilege code that could invoke keymint operations; however, this does not eliminate the vulnerability. No configuration-based workaround is available given the flaw is in core system logic.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today