Executive brief
Android's payment app selection dialog contains a vulnerability that allows an attacker to change the device's default payment application without proper authorization. This could enable an attacker to redirect financial transactions to a malicious payment app, potentially leading to fraud or unauthorized charges. The vulnerability requires no user interaction or special permissions to exploit and affects multiple Android versions.
Technical details
A confused deputy vulnerability exists in the onCreate method of PaymentDefaultDialog.java in Android's Framework component. The vulnerability allows an unprivileged local process to manipulate the default payment app selection through improper permission or intent validation. An attacker with local access to the device can exploit this without requiring additional execution privileges or user interaction. This leads to local privilege escalation and could result in unauthorized modification of system settings related to payment handling. Patches are available in Android 14, 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue