Android EUVD-2026-73999

Requires local code execution with at least low-level user privileges - specifically, an app installed on the device (via user install, MDM push, or exploit chain). No root or system permissions are required as a prerequisite. No user interaction is needed after the app is running. The attack is limited to local access (AV:L); remote exploitation is not possible without a prior foothold. The vulnerability is present in default Android configurations across versions 14-17, with no special feature flag or non-default setting required to be exposed. Key limiting factors: the attacker must get code onto the device (requires app install or prior exploit), and the attack is not automatable (SSVC: Automatable: no), suggesting some device-specific or timing conditions complicate mass exploitation.

The CVSS 7.8 score and a total technical impact assessment (SSVC: Technical Impact: total) reflect that successful exploitation grants full device access - confidentiality, integrity, and availability all rated High. However, the realistic threat is tempered by several factors: AV:L means an attacker must already have a foothold on the device (installed app with user-level code execution), and SSVC marks exploitation as 'none' currently. EPSS at 0.15% (5th percentile) aligns with no observed in-the-wild exploitation. The non-automatable SSVC flag indicates this is not a spray-and-pray campaign vulnerability. Still, even a mid-sized municipal IT team in mielec managing a fleet of Android devices should treat this as a meaningful patching priority, since any low-privilege application - including sideloaded or malicious Play Store apps - could weaponize this to silently escalate to full device control without alerting the user. The absence of a KEV listing and low EPSS suggest the exploitation bar is currently non-trivial, but the wide Android version coverage (14 through 17) and large installed base elevate aggregate risk considerably.

A malicious Android app installed on the target device with standard user permissions triggers the BiometricsSettingsBase fragment's onAttach method in a crafted manner, causing the biometrics settings component to execute privileged system operations on the attacker app's behalf. The confused deputy grants the malicious app access it was never authorized to hold, resulting in complete compromise of device confidentiality, integrity, and availability. No user interaction is required after the app is installed.