CVE-2026-0017: Android Frameworks Base and Settings Package Local Privilege Escalation Vulnerability
Summary
CVE-2026-0017: In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. Affects platform/frameworks/base across 3 version ranges.
>= 16:0, < 16:2026-03-01
>= 16-qpr2:0, < 16-qpr2:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential functionalities and services for applications. It manages system-level operations, including biometric services that allow users to unlock their devices using fingerprints or facial recognition. The Settings package is responsible for managing user preferences and configurations, including biometric settings. This vulnerability affects both packages, allowing unauthorized access to biometric unlock features.
Vulnerability Detail
In the onChange method of BiometricService.java, a logic error exists that could enable fingerprint unlock without proper authorization. This flaw allows local escalation of privilege, meaning that an attacker with physical access to the device could exploit this vulnerability to gain unauthorized access to the device's biometric unlock features. The vulnerability does not require any additional execution privileges or user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable biometric unlock features until the patch is applied. This can be done by navigating to Settings > Security > Biometric Unlock and turning off the fingerprint and facial recognition options.
Conclusion
CVE-2026-0017 is a significant vulnerability affecting the Android Frameworks Base and Settings packages, allowing local privilege escalation through a logic error in biometric services. Users are advised to update their devices to the patched versions to mitigate this risk and consider disabling biometric unlock features until the update is applied.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-0017 is a vulnerability in the Android Frameworks Base and Settings packages that allows local privilege escalation through a logic error in biometric services.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If you cannot update your device immediately, disable biometric unlock features as a temporary measure to prevent unauthorized access.
No, user interaction is not required to exploit this vulnerability, making it particularly concerning.
The potential consequences include unauthorized access to the device, allowing an attacker to bypass security measures and access sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
