Executive brief
Android's notification system has a logic error in how it hides sensitive information from notifications. Contact names can be inadvertently exposed to local processes on the device, allowing any app to see private contact information without special permissions. An attacker with local access could exploit this to extract contact details.
Technical details
This vulnerability exists in the ExpandableNotificationRow.java component of the Android Framework's notification system. A logic error in the setHideSensitive() method fails to properly redact contact names from notification objects, causing sensitive information disclosure through local information access. The vulnerability affects all Android versions 14, 15, and 16, and requires no special execution privileges or user interaction for exploitation. The issue has been addressed with patches available in AOSP for the affected versions.
Affected products
- Google Android 14, 15, 16
Timeline
- 2026-03-02: disclosed
- 2026-03-05: patched: Security patch level 2026-03-05 or later addresses this issue