Executive brief
A missing permission check in Android's credential confirmation system allows unauthorized local access to and modification of device credentials. An attacker with no special privileges can exploit this to read or alter sensitive authentication data without user interaction, potentially compromising device security and unlocking restricted functions.
Technical details
This vulnerability exists in ConfirmDeviceCredentialActivity.java due to a missing permission check in the onCreate method. The vulnerability class is authorization bypass (missing access control). The attack vector is local; no network access is required. An attacker with local code execution (installed app or shell access) can invoke the vulnerable activity to directly access or modify device credentials without proper permission validation. No user interaction is required for exploitation. The vulnerability leads to local information disclosure and potential modification of authentication credentials. Patches are available in AOSP for Android 14, 15, 16, 16-qpr2, and 17 with the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 and later address this issue