Executive brief
Android's Factory Reset Protection (FRP) is a security feature that prevents unauthorized access to a device after a factory reset. A logic error in the AccountsDb component's account authentication code allows an attacker to bypass FRP and gain local control of the device without requiring any special privileges or user interaction.
Technical details
This vulnerability is a logic error in the findMetaAuthUid method of AccountsDb.java that allows bypass of Android's Factory Reset Protection (FRP). The flaw permits local escalation of privilege without additional execution privileges required; no user interaction is needed for exploitation. The affected component is part of the Android Framework, and the vulnerability impacts multiple Android versions (14 through 17). Patches are available in AOSP for all affected versions as of the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin September 2026
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue