CVE-2026-0005: 
NixOS vulnerability analysis and mitigation

CVE-2026-0005 is a security feature bypass vulnerability in Android's KeyguardServiceDelegate.java that allows a partial bypass of app pinning, enabling limited interaction with other apps without knowledge of the Lock Screen Knowledge Factor (LSKF). The flaw affects Android versions 14.0, 15.0, and 16.0. It was published on March 2, 2026, with a patch included in the Android March 2026 security bulletin. It carries a CVSS v3.1 base score of 6.2 (Medium) (Android Security Bulletin, Red Hat CVE).

The vulnerability is rooted in a missing permission check within the onServiceDisconnected method of KeyguardServiceDelegate.java, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). When the keyguard service disconnects unexpectedly, the missing check fails to enforce app pinning restrictions, allowing a local attacker to interact with applications outside the pinned app context without providing the LSKF. No elevated privileges are required, and no user interaction is needed for exploitation. The attack vector is local, meaning physical or logical access to the device is a prerequisite (Android Security Bulletin).

Successful exploitation leads to local information disclosure, where the scope and severity of exposed data is dependent on what other installed applications expose during unauthorized interaction. An attacker with local access to a device in app pinning mode could access sensitive information from other apps — such as notifications, on-screen content, or app-specific data — without unlocking the device. There is no impact on integrity or availability, and the vulnerability does not grant elevated execution privileges (Android Security Bulletin, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires local access to the device, which significantly limits the exploitable attack surface (Android Security Bulletin).

1. Physical or local access: Obtain physical access to an Android device (versions 14.0, 15.0, or 16.0) that has app pinning enabled and is in a locked/pinned state.
2. Trigger service disconnection: Cause or wait for the KeyguardService to disconnect — this may occur due to system resource pressure, app crashes, or other system events that trigger onServiceDisconnected in KeyguardServiceDelegate.java.
3. Exploit missing permission check: During the service disconnection window, the missing permission check fails to re-enforce app pinning restrictions, allowing interaction outside the pinned app.
4. Access other apps: Interact with other applications or system UI elements that become accessible, potentially viewing sensitive on-screen content, notifications, or app data without providing the LSKF.
5. Exfiltrate information: Capture or record any sensitive information exposed by other apps during the bypass window (Android Security Bulletin).

Google released a patch addressing this vulnerability in the Android March 2026 security bulletin (patch level 2026-03-01). Users and administrators should update affected Android devices running versions 14.0, 15.0, or 16.0 to the patched security patch level as soon as possible. As a temporary workaround in high-security environments, consider restricting or disabling the use of app pinning until devices are patched, and educate users that app pinning should not be relied upon as a primary security control. Samsung and Huawei have also incorporated the patch into their respective March 2026 and May 2026 security updates (Android Security Bulletin, Samsung March 2026).

The CIS issued an advisory noting multiple vulnerabilities in the Google Android OS that could allow for remote code execution and other impacts, including CVE-2026-0005, recommending prompt patching (CIS Advisory). No significant independent researcher commentary or notable social media discussion has been identified for this specific CVE, consistent with its medium severity rating and lack of public exploit code.