CVE-2026-45520

Google's Android has disclosed a confused-deputy flaw (CWE-441) in onAttach of BiometricsSettingsBase.java, the component of the Android Settings app that manages fingerprint and face-unlock configuration. A local application with no special permissions can trigger the flaw, in which a higher-privileged Settings component acts on behalf of the caller and can be tricked into bypassing an authentication check; no user interaction is required for exploitation. Successful exploitation yields local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). Android devices running builds that include the affected Settings biometrics code are potentially exposed, although the available data does not specify exact affected version ranges. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS assigns only a 0.1% probability of exploitation within 30 days (5th percentile).

What to do: Install the Android security update that fixes CVE-2026-45520 as soon as it is delivered via the monthly Android security bulletin or your device OEM, then verify the device's security patch level reflects the fix. Because exploitation requires only low-privilege local access and no user interaction, prioritize updates for devices where users can install apps from untrusted sources; no workaround is documented in the available data. Check the Android security bulletin for the exact affected versions and patch levels as OEM rollouts proceed.