Google Settings App: Location Access Can Be Disabled by Malicious Code

Summary

The Google Settings app has a bug that could allow a malicious user to turn off location access without permission. This could be exploited by an attacker to gain more access to a device than they should have. Users should update their Google Settings app to the latest version to fix this issue.

What to do

Update google platform/frameworks/base to version 16-qpr2-next:2026-03-01.
Update google platform/frameworks/base to version 15:2026-03-01.
Update google platform/frameworks/base to version 16:2026-03-01.
Update google platform/frameworks/base to version 16-qpr2:2026-03-01.
Update google platform/frameworks/base to version 14:2026-03-01.

Affected software

Vendor	Product	Affected versions	Fix available
google	android	14.0	–
google	android	15.0	–
google	android	16.0	–
google	android	16.0	–
google	android	16.0	–
google	android	16.0	–
google	platform/frameworks/base	> 16-qpr2-next:0 , <= 16-qpr2-next:2026-03-01	16-qpr2-next:2026-03-01
google	platform/frameworks/base	> 15:0 , <= 15:2026-03-01	15:2026-03-01
google	platform/frameworks/base	> 16:0 , <= 16:2026-03-01	16:2026-03-01
google	platform/frameworks/base	> 16-qpr2:0 , <= 16-qpr2:2026-03-01	16-qpr2:2026-03-01
google	platform/frameworks/base	> 14:0 , <= 14:2026-03-01	14:2026-03-01

Original title

In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with n...

Original description

In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvd CVSS3.1 8.4

Vulnerability type

CWE-693 Protection Mechanism Failure

CWE-703