CVE-2026-0134: Android Factory Reset Data Persistence Vulnerability

Technical summary

CVE-2026-0134 stems from a flaw in the PostWipeData function within recovery_ui.cpp on Android devices. During factory reset operations, certain data structures fail to be properly cleared due to a logic error in the code path. This allows residual sensitive information to remain accessible in memory or storage that should have been erased. The vulnerability requires local access but no elevated privileges, and exploitation occurs without user interaction once physical or logical device access is established.

Business impact

For device manufacturers and carriers, this vulnerability undermines the integrity of the factory reset feature—a critical mechanism for data sanitization. Organizations managing device fleets, retailers processing returned devices, and customers reselling hardware face elevated risk of data leakage. This could result in regulatory compliance issues (GDPR, state privacy laws), customer trust erosion, and potential liability if personal or sensitive corporate data is exposed through seemingly-wiped devices.

Affected systems

Google Android devices are affected. The vulnerability exists in the recovery partition's UI component. Specific version ranges should be verified against Google's official security advisory, as patch versions are not enumerated in the available intelligence. Devices running affected Android versions that have not received the patched recovery image remain vulnerable.

Exploitability

Exploitation requires local access to the device—either physical possession or logical access via ADB (Android Debug Bridge) or similar local interfaces. No network access, no elevated system privileges, and no user interaction are required once access is obtained. This makes the vulnerability practical for attackers with hands-on device access, such as supply chain actors, refurbishment facilities, or individuals with temporary physical possession. The low CVSS score (3.3) reflects the local-only attack vector, but the real-world risk is elevated in scenarios where devices change hands.

Remediation

Apply the security patch provided by Google for affected Android versions. The patch addresses the logic error in PostWipeData to ensure complete data sanitization during factory reset. Device manufacturers should prioritize deploying this update to their recovery partitions. Organizations should verify patch availability for their specific device models and Android versions through official vendor channels.

Patch guidance

Consult Google's official Android Security & Privacy Year in Review or security bulletin for specific patched versions and release timelines. Device-level patches typically ship as system updates; verify your device model's update status through Settings > About Phone > System Update. For enterprise-managed devices, use your MDM platform to verify and enforce deployment of patched recovery images. Test patches in a controlled environment before wide-scale rollout to ensure no impact on factory reset workflows.

Detection guidance

Detection of past exploitation is difficult, as the vulnerability leaves residual data rather than forensic artifacts of the attack itself. Monitor for unusual access to recovery mode or repeated factory reset attempts on managed devices. For forensic investigation of potentially compromised devices, engage data recovery specialists to analyze unallocated space post-reset. Implement device inventory and history tracking to identify devices that may have been subject to unauthorized access before reaching end users.

Why prioritize this

Although assigned a LOW severity score due to its local-attack-only nature, this vulnerability should receive attention proportional to your organization's role in the device lifecycle. For retailers, refurbishment centers, and managed-device programs, prioritize patching to protect customer privacy and regulatory compliance. For individual consumers, prioritization is lower unless you plan to resell or donate your device soon. The gap between CVSS score and business risk underscores the importance of context-driven remediation strategies.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects a local attack vector (AV:L), low complexity (AC:L), and limited privilege requirements (PR:L), with confidentiality impact (C:L) but no integrity or availability impact. This scoring appropriately captures the technical constraints: an attacker must already have local device access. However, the score does not account for the strategic importance of factory reset as a data-protection mechanism, nor the supply-chain and refurbishment scenarios where local access is commonplace. Risk assessment should layer business context on top of the CVSS metric.

Frequently asked questions