CVE-2026-0145: KeyMint Permission Bypass Allows Local Information Disclosure on Android

Technical summary

KeyMint, Android's hardware-backed keystore abstraction layer, contains a logic error in permission enforcement (CWE-862: Missing Authorization) that permits a local, low-privileged process to bypass intended access controls and disclose confidential information. The vulnerability requires only local access (AV:L) and low privileges (PR:L), with no user interaction needed (UI:N) and no impact on system integrity or availability. The confined scope (S:U) means the breach affects only the KeyMint component's security domain.

Business impact

While rated LOW severity, this vulnerability poses a meaningful privacy risk for organizations handling sensitive credential material or cryptographic keys on Android devices. Attackers with local access—such as malicious applications in enterprise deployments or device maintenance scenarios—could extract confidential data stored in KeyMint without triggering alerts. For financial services, healthcare, or government entities relying on Android devices for authentication or encryption, even information disclosure can compromise compliance postures and enable downstream attacks through credential inference.

Affected systems

Google Android devices and systems using the KeyMint component are affected. The vulnerability does not appear version-specific in the published disclosure; verify the exact Android versions impacted by consulting Google's official security bulletin and your device inventory. KeyMint is a core Android security service introduced in Android 9 and present in all modern Android releases.

Exploitability

Exploitation is straightforward for a local attacker already on the device. No network access, special tools, or user interaction is required—only the ability to execute code with standard user privileges. This makes the vulnerability practical to exploit in scenarios where untrusted applications are installed, devices are physically accessible to adversaries, or supply-chain compromises introduce malicious pre-loaded software. The absence of active exploitation reports (KEV not listed) suggests either limited real-world weaponization or slow disclosure awareness.

Remediation

Apply the security patch provided by Google for your Android version as soon as it is released or made available through your device manufacturer. The fix addresses the authorization logic error in KeyMint. Organizations should prioritize patching devices handling high-value credentials or operating in sensitive environments. Until patching is feasible, restrict the installation of untrusted third-party applications and use Mobile Device Management (MDM) policies to limit local code execution on critical devices.

Patch guidance

Monitor Google's Android Security & Privacy Year in Review and your device manufacturer's security bulletins for the patch release date and associated Android patch level. Apply patches through your device's standard system update mechanism or through your MDM console if managing fleet devices. Verify patch application by confirming the security patch level in device settings matches or exceeds the remediation date published in the advisory. Note: specific patch version numbers were not disclosed in the published advisory; verify against vendor documentation before rollout.

Detection guidance

Detection of active exploitation is difficult without telemetry from the KeyMint service itself. At the host level, monitor for unusual process creation under low-privilege user accounts attempting to access the KeyMint daemon or system keycrypto interfaces. On fleet management platforms, track system update compliance and confirm all devices have received the latest security patch level. Consider capturing and analyzing KeyMint service logs if your device platform supports granular audit logging; focus on permission denial events or repeated failed authorization attempts that may precede a successful bypass.

Why prioritize this

Despite a LOW CVSS score, prioritization should be informed by your organization's data sensitivity and device usage model. Classify as medium priority if your enterprise deploys Android devices for financial transactions, VPN access, or certificate-based authentication; low priority if devices are consumer-facing or used only for non-sensitive operations. The lack of KEV listing and apparent limited real-world exploitation lower immediate urgency, but the ease of local exploitation (no user interaction required) warrants timely remediation before threat actors mature attack chains.

Risk score, explained

CVSS 3.1 score of 3.3 (LOW) reflects the vulnerability's limited scope: local access only, no integrity or availability impact, and only low-privileged users affected. The score appropriately discounts the risk because exploitation does not lead to code execution, privilege escalation, or system compromise—only information disclosure within the KeyMint security boundary. However, the practical impact depends on what secrets are stored in KeyMint for your use case; a credential leak in a zero-trust architecture is more damaging than a leak in a perimeter-only model.

Frequently asked questions