Executive brief
A logic error in the Android operating system's settings component can allow a local attacker to disable location services on a device. This flaw could be used to bypass security protections or interfere with the normal operation of location-dependent applications. An exploit could lead to an unauthorized increase in system privileges without requiring any interaction from the user.
Technical details
A logic error exists within the 'enableSystemPackageLPw' method of 'Settings.java' in the Android Framework. This vulnerability allows a local attacker to trigger a condition that prevents location access from working correctly across the system. The flaw is categorized as a protection mechanism failure (CWE-693) or improper handling of exceptional conditions (CWE-703). Exploitation does not require additional execution privileges or user interaction and can result in local escalation of privilege (EoP). Google has released patches for this issue in the March 2026 Android Security Bulletin (patch level 2026-03-05).
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-03-02: advisory: Initial publication by Google/Android and NVD
- 2026-03-05: patched: Security patch level 2026-03-05 addresses this issue