CVE-2026-0012: 
NixOS vulnerability analysis and mitigation

CVE-2026-0012 is a local information disclosure vulnerability in Android's notification system, specifically in the setHideSensitive function of ExpandableNotificationRow.java. A logic error in this function allows contact names to leak from notifications even when the device is configured to hide sensitive notification content. The vulnerability affects Google Android versions 14.0, 15.0, and 16.0. It was published on March 2, 2026, with patches included in the Android March 2026 security bulletin. It carries a CVSS v3.1 base score of 6.2 (Medium) (Android Bulletin, Red Hat CVE).

The root cause is a logic error (CWE-284: Improper Access Control; CWE-693: Protection Mechanism Failure) in the setHideSensitive method of ExpandableNotificationRow.java, which is responsible for hiding sensitive content in Android's notification shade. When a device is set to conceal sensitive notification details on the lock screen or in other restricted contexts, the flawed logic fails to properly suppress contact names, causing them to remain visible. Exploitation requires only local access to the device — no elevated privileges or user interaction are needed (Android Bulletin).

Successful exploitation results in the disclosure of contact names from notifications that should be hidden under sensitive notification display settings, impacting confidentiality. There is no impact on integrity or availability. The scope is limited to the local device, but the exposed contact names could reveal sensitive personal or professional relationships to anyone with physical or local access to the device (Android Bulletin, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.009% (0.000090), reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Physical or local access: Obtain physical access to an Android 14, 15, or 16 device that has "hide sensitive notification content" enabled in display/lock screen settings.
2. Trigger notification display: Cause a notification involving a contact (e.g., an incoming message or call) to appear on the device's lock screen or notification shade.
3. Observe leaked contact name: Due to the logic error in setHideSensitive, the contact name is displayed in the notification even though the device is configured to hide sensitive content.
4. Collect information: Record the exposed contact names for reconnaissance or social engineering purposes without needing any special privileges or triggering any user interaction (Android Bulletin).

Google released patches for this vulnerability in the Android March 2026 security bulletin (patch level 2026-03-01). Users and administrators should apply the March 2026 Android security update to all affected devices running Android 14.0, 15.0, or 16.0. As a temporary workaround, restricting physical access to unlocked devices and disabling notification previews on the lock screen can reduce exposure until the patch is applied (Android Bulletin).

The CIS (Center for Internet Security) published an advisory noting multiple vulnerabilities in the March 2026 Android security update, including CVE-2026-0012 (CIS Advisory). Samsung acknowledged the patch in its March 2026 security patch details (SammyFans). GBHackers reported on the broader Android security update fixing 129 flaws, of which CVE-2026-0012 was one (GBHackers). Huawei also referenced the vulnerability in its April 2026 security bulletin (Huawei Bulletin). Community reaction has been muted given the medium severity and lack of active exploitation.