In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 2, 2026 · NIST NVD

   Detected

   In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

2. Oct 1, 2026 · NIST NVD

   Updated

   In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

• cpe google/android16.0

Sources

• CVE.orgVulnerability recordCVE-2026-0017

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-0017

  In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  nvd.nist.gov

References

• Reference · seclists.org
• Reference · openwall.com
• Reference · source.android.com