CVE-2026-0005
MEDIUM EPSS 1.2%
Published Mar 2, 20264mo ago · Modified Jun 17, 20261w ago
6.2 CVSS 3.1
Published Mar 2, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago
Description
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
1.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
Affected Products 3
References 1
- source.android.com https://source.android.com/docs/security/bulletin/2026/2026-03-01
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.