CVE-2026-15365: Kids Mode Authentication Bypass Vulnerability

CVE-2026-15365 Overview

CVE-2026-15365 is a business logic flaw in the Kids Mode feature affecting Vivo devices. A pop-up handling issue lets a user bypass password verification and launch Quick Apps outside of the Kids Mode sandbox. The weakness is categorized as [CWE-841] (Improper Enforcement of Behavioral Workflow). Exploitation requires physical access to an unlocked device and yields limited disclosure and integrity impact. Vivo published details in Security Advisory #25.

Critical Impact
A user with physical access to a device in Kids Mode can escape the parental control sandbox and use Quick Apps without entering the guardian password.

Affected Products

Vivo devices featuring Kids Mode (see vendor advisory for exact builds)
Kids Mode Quick Apps launcher component
Related Vivo OS builds referenced in Vivo Security Advisory #25

Discovery Timeline

2026-08-26 - CVE-2026-15365 published to NVD
2026-08-26 - Last updated in NVD database
Reference - Vivo Security Advisory #25

Technical Details for CVE-2026-15365

Vulnerability Analysis

Kids Mode restricts device usage to a curated set of applications and requires a guardian password to exit the sandbox or launch unapproved apps. The vulnerability arises from a logic flaw in how a specific pop-up dialog handles user interaction. Instead of enforcing password verification before dispatching the Quick App intent, the flow allows the Quick App to launch in the standard runtime context outside Kids Mode. The attacker gains access to Quick App functionality that should sit behind the parental gate.

The issue is classified under [CWE-841] because the workflow does not enforce the required verification step in the expected order. Impact is bounded because Quick Apps are lightweight and the runtime does not itself grant elevated privileges. Confidentiality, integrity, and scope impacts are low, and availability is not affected.

Root Cause

The root cause is missing state enforcement in the pop-up handler. The dialog treats a user action as sufficient to proceed with launching a Quick App without confirming that the Kids Mode password gate has been satisfied. The workflow trusts a UI event where it should require a completed authentication transaction.

Attack Vector

Exploitation requires physical possession of the target device while it is in Kids Mode. The attacker interacts with the affected pop-up UI to trigger the Quick App launch path. No network access, malware, or elevated permissions are needed. Because the attack vector is physical and complexity is low, the practical risk is limited to scenarios where a child or unauthorized user has hands-on access to a supervised device.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-15365

Indicators of Compromise

Quick Apps appearing in the recent-apps or usage history of a device that should be restricted to Kids Mode
Kids Mode session logs showing app launches without a preceding password verification event
Unexpected transitions from the Kids Mode UI to the standard Android launcher context

Detection Strategies

Review Vivo device usage statistics for Quick App executions during Kids Mode sessions
Correlate parental control audit logs against approved application allow-lists to spot unsanctioned launches
Monitor mobile device management (MDM) inventory changes on managed handsets that use Kids Mode as an access control

Monitoring Recommendations

Enroll family-shared devices in an MDM or parental oversight service that reports application launches
Enable Vivo account activity notifications where available to surface unexpected Quick App usage
Periodically inspect Screen Time or Digital Wellbeing counters on the device for anomalous activity outside Kids Mode

How to Mitigate CVE-2026-15365

Immediate Actions Required

Install the latest Vivo OS security update that addresses Vivo Security Advisory #25
Verify that Kids Mode is running the patched version before relying on it as an access control
Limit physical access to devices that store sensitive accounts or payment methods behind Kids Mode

Patch Information

Vivo has published remediation guidance in Vivo Security Advisory #25. Apply the vendor-provided system update through Settings, System, and System update on affected devices. Confirm the patch level after installation and reboot.

Workarounds

Disable Quick Apps at the system level while a patch is pending, if the option is available on the device
Use a stronger primary device lock (PIN or biometric) so Kids Mode is entered from a trusted state
Supervise device use directly rather than relying solely on Kids Mode as a security boundary until updates are applied