CVE-2026-0017
Published: 02 March 2026
Summary
CVE-2026-0017 is a high-severity Improper Authorization (CWE-285) vulnerability in Google Android. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
The logic error in BiometricService.java represents a failure to enforce approved authorizations, allowing unauthorized enabling of fingerprint unlock and local privilege escalation.
Requires identification, reporting, and correction of the specific flaw in BiometricService.java to prevent exploitation of the improper authorization vulnerability.
Enforcing least privilege restricts unprivileged local attackers from enabling fingerprint unlock, mitigating the escalation pathway despite the logic error.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via exploitation of a biometric logic flaw with no user interaction required.
NVD Description
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed…
more
for exploitation.
Deeper analysisAI
CVE-2026-0017 is a logic error in the onChange method of BiometricService.java within the Android operating system. This flaw enables an attacker to activate fingerprint unlock functionality, resulting in a local escalation of privilege. No additional execution privileges are required for exploitation, and user interaction is unnecessary. The vulnerability is rated 7.7 on the CVSS v3.1 scale (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is associated with CWE-285 (Improper Authorization) and CWE-693 (Protection Mechanism Failure).
A local attacker can exploit this vulnerability with low complexity and no privileges, as indicated by the CVSS vector. Successful exploitation allows the attacker to gain elevated privileges, compromising high levels of confidentiality and integrity without affecting availability.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01, published on 2026-03-01, provides details on available patches and mitigation guidance for addressing this issue.
Details
- CWE(s)