Executive brief
A vulnerability in Android's payment settings could allow a malicious application to change the device's default NFC payment provider without the user's knowledge. This could be used to redirect contactless payments to a fraudulent app, potentially leading to financial theft or unauthorized transactions. The issue affects the core Android system and does not require any special permissions or user interaction to exploit.
Technical details
An improper input validation vulnerability exists in the 'setDefaultKey' method of 'DefaultPaymentSettings.java' within the Android System component. A local malicious application, including those running within a work profile, can exploit this flaw to programmatically set the main user's default NFC payment provider. The attack requires no additional execution privileges and no user interaction (UI:N). This leads to a local escalation of privilege (EoP) by allowing an unprivileged app to alter sensitive system-level payment configurations. The vulnerability is addressed in the June 2026 Android Security Bulletin.
Affected products
- Google Android 13, 14, 15, 16
Timeline
- 2025-12-08: disclosed: Initial NVD publication
- 2026-06-01: patched: Android Security Bulletin update with AOSP versions