CVE-2026-45520 in Android
Summary
by MITRE • 09/08/2026
In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in the Android biometric subsystem represents a critical security flaw rooted in improper access control mechanisms within the BiometricsSettingsBase.java component, specifically during its onAttach lifecycle method. This issue manifests as a confused deputy problem, where an authorized entity is tricked into performing unauthorized actions or accessing resources it should not have permission to touch. In this context, the system fails to adequately verify that the caller requesting biometric authentication settings actually has the legitimate authority to do so, allowing malicious applications or processes to manipulate the state of biometric security features without proper authorization checks.
From a technical perspective, the flaw lies in the failure to enforce strict identity verification when attaching components related to biometric configuration. The Android framework relies on robust permission models and context validation to ensure that only privileged system services or explicitly authorized user interfaces can modify sensitive settings such as fingerprint enrollment status or face unlock configurations. When this check is bypassed due to a confused deputy scenario, an attacker with minimal privileges can exploit the misconfiguration to alter these security parameters. This effectively neutralizes one of the primary layers of device protection, allowing unauthorized access to secured areas of the operating system and user data.
The operational impact of this vulnerability is severe, as it facilitates local privilege escalation without requiring any additional execution privileges from the attacker or direct user interaction. Once exploited, an application with low-level permissions can disable biometric locks or manipulate authentication states, effectively granting itself higher levels of access to protected resources. This undermines the integrity of the device's security posture, potentially leading to data exfiltration, unauthorized system modifications, and complete compromise of user privacy. The lack of required user interaction makes this vulnerability particularly dangerous in scenarios where malicious code is executed silently through background processes or compromised legitimate applications.
This issue aligns with CWE-269 Improper Privilege Management, as it involves a failure to correctly assign and enforce privileges during the attachment phase of a system component. Furthermore, from an offensive security perspective, this behavior corresponds to ATT&CK technique T1548 Abuse Elevation Control Mechanism, where attackers manipulate operating system mechanisms to escalate their access levels. The confusion deputy aspect also relates closely to CWE-267 Directory Security Misconfiguration or more broadly CWE-937 Use of a Broken or Insecure Cryptographic Algorithm if the biometric data handling is compromised, but primarily it reflects a fundamental breakdown in trust boundaries within the application framework.
Mitigation strategies must focus on reinforcing identity verification and access control checks within the Android framework's biometric services. Developers should implement strict validation to ensure that only trusted system components or explicitly authorized callers can invoke methods related to biometric settings modification. This includes verifying the caller's UID, package name, and signature against a whitelist of allowed entities before proceeding with any state changes. Additionally, implementing robust logging and monitoring for unusual patterns in biometric configuration requests can help detect potential exploitation attempts early. Security patches should prioritize hardening these entry points by enforcing principle of least privilege, ensuring that default states are secure and that any deviation requires explicit, verified authorization from a privileged context. Regular code audits focusing on confused deputy vulnerabilities across the framework will further reduce the attack surface for such local escalation attacks.