Executive brief
A vulnerability in Android's Wallet service allows apps to access wallet payment information without proper permission verification. An attacker could read sensitive financial data from a user's wallet without special privileges or user interaction, potentially leading to unauthorized access to payment methods and personal financial information.
Technical details
The vulnerability exists in the isCallerAllowed() method of WalletContextualLocationsService.kt due to a missing permission check. This allows any local app to call wallet APIs and retrieve sensitive wallet information without requiring the expected permission-based authorization. The attack vector is local, requiring only that a malicious app be installed on the device. No additional execution privileges or user interaction are needed. An attacker can directly access wallet data through the exposed service. Patches are available in Android 14, 15, 16, and 16-qpr2 as part of the September 2026 security bulletin.
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-09-08: disclosed
- 2026-09-01: patched: Security patch level 2026-09-01 or later addresses this issue