PT-2026-4697 · Google · Android

Published 2026-01-25 · Updated 2026-06-01 · CVE-2026-0016

NVD

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-0016

Affected Products

Android

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-0016 · Security Note
• https://source.android.com/docs/security/bulletin/2026/2026-06-01 · Note
• https://twitter.com/GrapheneOS/status/2015510661019644403 · Twitter Post