EUVD-2026-33804
GHSA-cqcr-4cr7-x5jj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryRequest KeyChain certificate access
-
ExploitTrigger misleading getApplicationLabel rendering
-
ExecutionUser approves spoofed consent prompt
-
PersistObtain use of victim certificate/private key
-
ImpactImpersonate user to enterprise services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires the attacker to already have code execution on the device as an unprivileged local app (CVSS AV:L, PR:L) - typically via a sideloaded or Play-distributed malicious application - running on Android 14, 15, 16, or 16-qpr2 prior to the 2026-06-01 patch level. The vulnerable path is reached only when at least one KeyChain-stored credential exists and the user is presented with the KeyChainActivity consent prompt for that credential. Limiting factors: the attack targets the KeyChain credential-grant flow specifically (devices with no provisioned certificates are not exposed to meaningful impact), and although the CVSS vector encodes UI:N, the description indicates the user must approve the misleading prompt - defenders should treat user approval as a practical prerequisite despite the vector. |
| Impact | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) classifies this as local, low-complexity, low-privilege with high impact across confidentiality, integrity, and availability - consistent with a malicious app already installed on the device escalating to obtain another app's or the user's certificate trust. SSVC tempers urgency: Exploitation=none, Automatable=no, Technical Impact=total, indicating high per-incident damage but low likelihood of mass exploitation. There is a notable internal tension in the source data: the CVSS vector encodes UI:N (no user interaction) yet the description explicitly says the attack works by tricking the user into approving access - this should be verified with Google, as it materially changes the realistic exploitation path. No public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS was not provided. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app that requests access to a stored certificate; because getApplicationLabel returns a misleading or insufficient label, the consent dialog appears to reference a legitimate app the user trusts (for example, a corporate VPN client). The user approves, and the malicious app obtains use of the private key, enabling impersonation against the corresponding enterprise service. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Android 14 through 16-qpr2 stems from misleading UI rendering in KeyChainActivity's getApplicationLabel function, which can deceive users into granting certificate access to a malicious application. SSVC indicates no observed exploitation and the attack is not automatable, but technical impact is rated total, and no public exploit was identified at time of analysis.
RemediationAI
Apply the Android security patch level dated 2026-06-01 or later as documented in the June 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-06-01); exact AOSP build identifiers are not enumerated in the provided data, so confirm the patched build for your device fleet with the OEM. No vendor-released fix version was independently provided beyond the bulletin reference, so treat this as patch available per vendor advisory. As compensating controls until devices receive the OTA, restrict installation of untrusted apps through MDM (disable sideloading and unknown sources), instruct users to scrutinize app names and icons in KeyChain consent prompts, and on managed devices avoid provisioning sensitive client certificates (VPN/EAP) onto unpatched builds - the trade-off is reduced functionality for enterprise authentication on those endpoints.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in getApplicationLabel within KeyChainActivity.java, the system component that mediates user consent for apps requesting access to credentials stored in Android's KeyChain (typically client certificates and private keys used for VPN, Wi-Fi EAP, or enterprise authentication). The root cause maps to CWE-451 (User Interface Misrepresentation of Critical Information): the label shown in the consent prompt is sourced in a way that allows a malicious app to present a misleading or insufficient identifier, so the user sees a name that does not accurately represent the requesting app. The affected CPE is cpe:2.3:a:google:android with EUVD-tracked versions Android 14, 15, 16, and 16-qpr2.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A privilege escalation vulnerability (CVE-2026-0094) in Android 14 through 16-qpr2 allows attackers to deceive users into granting unauthorized certificate access through misleading UI rendering in KeyChainActivity. Organizations with Android device fleets face risk of unauthorized access and data compromise without mitigation, particularly for devices unable to upgrade immediately.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict non-essential KeyChain functionality via mobile device management policies, deploy user education on certificate access prompts, implement certificate pinning where applicable, monitor device logs for suspicious certificate access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB