EUVD-2026-73999
GHSA-865v-fr92-gm37
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall low-privilege malicious app
-
DeliveryTrigger onAttach in BiometricsSettingsBase
-
ExploitConfused deputy forwards privileged request
-
ExecutionBypass authentication controls
-
PersistGain full system privileges
-
ImpactComplete device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Requires local code execution with at least low-level user privileges - specifically, an app installed on the device (via user install, MDM push, or exploit chain). No root or system permissions are required as a prerequisite. No user interaction is needed after the app is running. The attack is limited to local access (AV:L); remote exploitation is not possible without a prior foothold. The vulnerability is present in default Android configurations across versions 14-17, with no special feature flag or non-default setting required to be exposed. Key limiting factors: the attacker must get code onto the device (requires app install or prior exploit), and the attack is not automatable (SSVC: Automatable: no), suggesting some device-specific or timing conditions complicate mass exploitation. |
| Impact | The CVSS 7.8 score and a total technical impact assessment (SSVC: Technical Impact: total) reflect that successful exploitation grants full device access - confidentiality, integrity, and availability all rated High. However, the realistic threat is tempered by several factors: AV:L means an attacker must already have a foothold on the device (installed app with user-level code execution), and SSVC marks exploitation as 'none' currently. EPSS at 0.15% (5th percentile) aligns with no observed in-the-wild exploitation. The non-automatable SSVC flag indicates this is not a spray-and-pray campaign vulnerability. Still, even a mid-sized municipal IT team in mielec managing a fleet of Android devices should treat this as a meaningful patching priority, since any low-privilege application - including sideloaded or malicious Play Store apps - could weaponize this to silently escalate to full device control without alerting the user. The absence of a KEV listing and low EPSS suggest the exploitation bar is currently non-trivial, but the wide Android version coverage (14 through 17) and large installed base elevate aggregate risk considerably. |
| Exploit ScenarioDerived | A malicious Android app installed on the target device with standard user permissions triggers the BiometricsSettingsBase fragment's onAttach method in a crafted manner, causing the biometrics settings component to execute privileged system operations on the attacker app's behalf. The confused deputy grants the malicious app access it was never authorized to hold, resulting in complete compromise of device confidentiality, integrity, and availability. No user interaction is required after the app is installed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. Affects Android 14, 15, 16, 16-qpr2, and 17; no public exploit or CISA KEV listing identified at time of analysis.
RemediationAI
Apply the September 2026 Android Security Bulletin patches, available from https://source.android.com/docs/security/bulletin/2026/2026-09-01. Device users should install the 2026-09-01 security patch level or later via their device's system update mechanism. OEM-specific updates (e.g., Samsung One UI, Google Pixel monthly updates) may have different release dates but should include these fixes. Enterprise MDM administrators should audit enrolled device patch levels and enforce the September 2026 SPL via policy. No specific workaround is documented in available references. As a compensating control, organizations can restrict app sideloading and enforce Google Play Protect to reduce the likelihood of a malicious app reaching the device in the first place, though these controls do not eliminate the vulnerability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BiometricsSettingsBase.java is part of the Android Settings framework, managing the biometric enrollment and configuration UI (fingerprint, face unlock). The onAttach() method is an Android Fragment lifecycle callback invoked when the fragment attaches to its host Activity - at this point, the fragment may inherit or interact with the calling Activity's context and permissions. CWE-441 (Confused Deputy) describes a scenario where a component with legitimate elevated permissions is manipulated by a less-privileged caller into performing operations that the caller itself would not be authorized to perform directly. In this case, the biometrics settings fragment, which has access to privileged biometric configuration APIs, can be triggered via onAttach in a way that bypasses the intended caller authentication checks. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires a locally installed app with standard user-level privileges. Affected versions span Android 14 through the current Android 17 and Android 16-QPR2 release trains.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with low-privilege app required; no user interaction per description; full CIA impact upon escalation; scope unchanged (device-local).
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A local privilege escalation vulnerability in Android biometrics settings (versions 14-17) enables low-privileged apps to hijack the biometrics service and achieve full device compromise through a confused deputy attack, with no patch currently available. This affects Android users across multiple current OS versions and creates a pathway for malware to bypass authentication controls and access sensitive device functions without user awareness.
Restrict application installation to Google Play Store and block sideloading; monitor system logs for unexpected privilege escalation within biometrics components; implement app permission policies limiting biometrics access to essential applications; educate users on malware risks from untrusted app sources; deploy additional authentication factors independent of biometrics for high-value transactions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB