CVE-2026-45520 Overview
CVE-2026-45520 is an authentication bypass vulnerability in the Android onAttach method of BiometricsSettingsBase.java. The flaw is a confused deputy weakness [CWE-441] where a privileged component acts on behalf of a less-privileged caller without validating authority. A local attacker with low privileges can leverage the flaw to escalate privileges on the affected device. No user interaction is required, and no additional execution privileges are needed to trigger the bypass. Google addressed the issue in the Android Security Bulletin 2026-09-01.
Critical Impact
Local privilege escalation on Android devices through an authentication bypass in the biometrics settings component, exploitable without user interaction.
Affected Products
- Android (biometrics settings component)
- Devices covered by the Android Security Bulletin dated 2026-09-01
- OEM Android builds that ship the vulnerable BiometricsSettingsBase implementation
Discovery Timeline
- 2026-09-08 - CVE-2026-45520 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-45520
Vulnerability Analysis
The vulnerability resides in the onAttach lifecycle method of BiometricsSettingsBase.java, a base class used by biometric enrollment and management fragments in Android Settings. When the fragment attaches to its host activity, it performs privileged setup work but does not correctly verify that the caller is authorized to reach the protected biometric flow. An attacker on the device can drive Settings into invoking onAttach for the sensitive fragment through an intent path that bypasses the authentication gate normally enforced upstream.
Because Settings runs with elevated privileges relative to third-party apps, the attacker exercises those privileges indirectly. The result is local escalation of privilege affecting confidentiality, integrity, and availability of biometric-guarded functionality.
Root Cause
The root cause is a confused deputy [CWE-441]. The BiometricsSettingsBase fragment trusts that its host has already authenticated the user, but the attach path can be reached without that check occurring. The privileged component therefore acts on behalf of an unauthenticated principal.
Attack Vector
Exploitation is local. A malicious app or a user with shell access constructs an intent or navigation path that lands directly on the biometrics settings fragment, causing onAttach to run without prior authentication. The vulnerability does not require user interaction, and no additional Android permissions beyond those already held by the attacker are required. Refer to the Android Security Bulletin 2026-09-01 for the vendor's technical details.
Detection Methods for CVE-2026-45520
Indicators of Compromise
- Unexpected launches of Settings biometric enrollment or management activities initiated by non-Settings UIDs.
- Modifications to biometric enrollment state (new fingerprint or face templates) that do not correlate with a user-initiated Settings session.
- Application logs showing intent traffic targeting internal Settings fragments related to BiometricsSettingsBase.
Detection Strategies
- Audit installed applications for those declaring intents or components that navigate into Settings biometric flows.
- Correlate biometric template changes with foreground activity history to identify enrollments occurring without a legitimate user session.
- Monitor logcat and system event logs for anomalous fragment transactions involving biometrics settings.
Monitoring Recommendations
- Enforce mobile device management (MDM) policies that report Android security patch level and flag devices below the 2026-09-01 patch level.
- Alert on installations of untrusted apps that request access to biometric-related APIs or invoke Settings deep links.
- Track anomalous privilege changes on managed Android endpoints and forward events to a centralized analytics platform for correlation.
How to Mitigate CVE-2026-45520
Immediate Actions Required
- Apply the Android security patch level 2026-09-01 or later on all managed devices.
- Instruct users to install pending OEM system updates as soon as they are available.
- Restrict installation of applications from untrusted sources through MDM policy.
- Inventory devices that cannot receive the patch and plan compensating controls or replacement.
Patch Information
Google published the fix in the Android Security Bulletin 2026-09-01. Device manufacturers integrate the fix into their own monthly maintenance releases. Verify the patch level on each device under Settings, then confirm it reports 2026-09-01 or later.
Workarounds
- Limit sideloading and enforce Google Play Protect on managed devices until patches are deployed.
- Remove untrusted third-party applications, particularly those requesting biometric-adjacent capabilities.
- Require device passcode plus biometric re-enrollment for high-value accounts after patching to invalidate any templates added during a possible bypass window.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.