Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Google Settings app may let local user gain higher privileges

CVE-2026-45520 · published 2 months ago
Summary

The Android Settings application contains a coding mistake that could let someone with access to the device obtain higher system rights without needing extra permissions or any user interaction. This could let a malicious app or user perform actions normally reserved for administrators. Apply the latest system updates or patches from Google to fix the issue.

What to do
  • Update google platform/packages/apps/settings to version 17-next:2026-09-01.
  • Update google platform/packages/apps/settings to version 15:2026-09-01.
  • Update google platform/packages/apps/settings to version 16:2026-09-01.
  • Update google platform/packages/apps/settings to version 16-qpr2:2026-09-01.
  • Update google platform/packages/apps/settings to version 17:2026-09-01.
  • Update google platform/packages/apps/settings to version 14:2026-09-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/packages/apps/settings >= 17-next:0, < 17-next:2026-09-01
>= 15:0, < 15:2026-09-01
>= 16:0, < 16:2026-09-01
>= 16-qpr2:0, < 16-qpr2:2026-09-01
>= 17:0, < 17:2026-09-01
>= 14:0, < 14:2026-09-01
Fix: upgrade to 17-next:2026-09-01
– google android 17
14.0
15.0
16.0
Original advisory text
In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privile...
In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
Timeline
Published1 Sep 2026
Updated9 Oct 2026
First seen8 Sep 2026
Sources
ASB-A-490286986 · OSV
CVE-2026-45520 · NVD
CVE-2026-45520 · MITRE
Track software like this
Free during beta