CVE-2026-0094

{
  "id": "CVE-2026-0094",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-01T22:16:22.927",
  "lastModified": "2026-11-06T16:30:49.650",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
    },
    {
      "lang": "es",
      "value": "En getApplicationLabel de KeyChainActivity.java, existe una posible forma de engañar al usuario para que apruebe el acceso a los certificados debido a una interfaz de usuario (IU) engañosa o insuficiente. Esto podría llevar a una escalada local de privilegios sin necesidad de privilegios de ejecución adicionales. No se necesita interacción del usuario para la explotación."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Google",
          "product": "Android",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "16-qpr2",
              "status": "affected"
            },
            {
              "version": "16",
              "status": "affected"
            },
            {
              "version": "15",
              "status": "affected"
            },
            {
              "version": "14",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-01T00:00:00+00:00",
          "id": "CVE-2026-0094",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "02882AB1-7993-47DD-84A0-8DF4272D85ED"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*",
              "matchCriteriaId": "9123E1DD-8607-427B-82B9-6E44B96C90F1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://source.android.com/docs/security/bulletin/2026/2026-06-01",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}