CVE-2026-0094: Google Android Privilege Escalation Flaw

CVE-2026-0094 Overview

CVE-2026-0094 is a high-severity vulnerability in Google Android affecting the getApplicationLabel function within KeyChainActivity.java. The flaw stems from misleading or insufficient user interface elements that can trick users into approving access to certificates stored in the Android KeyChain. An attacker with local access can exploit this weakness to escalate privileges without requiring additional execution permissions. The vulnerability is classified under [CWE-451] (User Interface Misrepresentation of Critical Information) and impacts Android versions 14, 15, and 16, including QPR2 beta builds.

Critical Impact

Local privilege escalation via UI spoofing in the Android KeyChain certificate approval dialog, exposing sensitive certificate material to unauthorized applications.

Affected Products

• Google Android 14.0
• Google Android 15.0
• Google Android 16.0 (including QPR2 Beta 1, Beta 2, Beta 3)

Discovery Timeline

• 2026-06-01 - Google publishes Android Security Bulletin addressing the issue
• 2026-06-01 - CVE-2026-0094 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-0094

Vulnerability Analysis

The vulnerability resides in the getApplicationLabel method of KeyChainActivity.java, the Android component responsible for presenting certificate access approval dialogs to users. When a third-party application requests access to certificates managed by the Android KeyChain, the system displays a dialog identifying the requesting application by its label. The flaw allows a malicious application to supply a misleading label that misrepresents its identity in the approval prompt.

The issue maps to [CWE-451], where security-critical information is presented to the user in a way that obscures or misrepresents the actual security decision being made. Because the approval grants access to private keys and certificates, a successful UI deception leads directly to credential and key material exposure.

Root Cause

The root cause is improper validation and sanitization of application labels rendered by getApplicationLabel in the KeyChain approval flow. The function trusts application-supplied metadata without enforcing constraints that would prevent impersonation of system components or other trusted applications in the consent dialog.

Attack Vector

Exploitation requires local access through a malicious application installed on the device. The malicious app sets a crafted application label designed to mimic a trusted system application or service. When the app requests certificate access through the KeyChain API, the user sees a deceptive prompt and may approve the request believing it originates from a legitimate component. Approval grants the malicious app access to certificates, enabling privilege escalation.

The vulnerability requires low-privilege local code execution. No additional execution privileges are required beyond standard application installation.

Detection Methods for CVE-2026-0094

Indicators of Compromise

• Applications invoking KeyChain.choosePrivateKeyAlias() shortly after installation without legitimate certificate-handling functionality
• Application labels containing Unicode lookalike characters or names mimicking system services such as Google Play Services or Android System
• Unexpected entries in the KeyChain grant list (/data/misc/keychain/) associated with newly installed third-party packages
• Use of certificates by applications that do not perform documented enterprise, VPN, or authentication functions

Detection Strategies

• Audit installed application labels for impersonation of system packages and compare against the package name and signing certificate
• Monitor Android logcat entries from KeyChainActivity and com.android.keychain for unusual approval sequences
• Use mobile device management (MDM) telemetry to identify applications requesting certificate access outside approved enterprise policies
• Correlate certificate access grants with subsequent network activity that could indicate exfiltration or unauthorized authentication

Monitoring Recommendations

• Enroll devices in an MDM platform that reports installed package metadata, including labels and signatures
• Forward Android security event logs to a centralized analytics platform for label-mismatch and KeyChain-access analysis
• Establish baselines for which applications legitimately use the KeyChain in your environment and alert on deviations
• Review the Android Security Bulletin 2026-06-01 for vendor-supplied identification guidance

How to Mitigate CVE-2026-0094

Immediate Actions Required

• Apply the June 2026 Android security patch level (2026-06-01) to all managed devices once available from your device manufacturer
• Audit currently installed applications for KeyChain access grants and revoke entries that cannot be tied to a legitimate business function
• Restrict sideloading and limit installation sources to vetted app stores through MDM policy
• Educate users to verify the package name and developer of any application requesting certificate access

Patch Information

Google addresses CVE-2026-0094 in the Android Security Bulletin dated 2026-06-01. Device manufacturers integrate the fix into their respective monthly security update releases. Administrators should track vendor advisories for affected device models and confirm the patch level reaches 2026-06-01 or later. Reference the Android Security Bulletin 2026-06-01 for the complete advisory.

Workarounds

• Deny certificate access requests from any application whose identity cannot be independently verified
• Use enterprise device management to allowlist applications permitted to interact with the KeyChain
• Configure work-profile separation so that personal applications cannot request access to enterprise certificates
• Remove unused or stale certificate entries from the Android KeyChain to reduce exposure if approval is mistakenly granted

# Review installed packages and KeyChain grants via adb on a managed device
adb shell pm list packages -f -U
adb shell dumpsys user
adb shell cmd package list packages --show-versioncode | sort
# Inspect KeyChain grant storage (requires elevated access)
adb shell ls -l /data/misc/keychain/