EUVD-2026-73999
GHSA-865v-fr92-gm37
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with low-privilege app required; no user interaction per description; full CIA impact upon escalation; scope unchanged (device-local).
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
5DescriptionCVE.org
In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local code execution with at least low-level user privileges - specifically, an app installed on the device (via user install, MDM push, or exploit chain). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score and a total technical impact assessment (SSVC: Technical Impact: total) reflect that successful exploitation grants full device access - confidentiality, integrity, and availability all rated High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the September 2026 Android Security Bulletin patches, available from https://source.android.com/docs/security/bulletin/2026/2026-09-01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine which Android versions (14, 15, 16, 16-qpr2, 17) are deployed across managed and employee devices, and audit which apps have biometrics permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today