Executive brief
Android's biometric authentication settings component contains an authentication bypass vulnerability due to a confused deputy issue. An attacker with local access can escalate their privileges without needing additional permissions or user interaction, potentially compromising device security and sensitive biometric data.
Technical details
This vulnerability is an authentication bypass (confused deputy) in the onAttach method of BiometricsSettingsBase.java within the Android Framework. The vulnerability allows local escalation of privilege (EoP) with no additional execution privileges required and no user interaction needed. The flaw stems from improper permission checking when handling biometric authentication settings, allowing a local attacker to bypass security restrictions. Patches are available in Android AOSP versions 14, 15, 16, 16-qpr2, and 17 as part of the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched