CVE-2026-0094: KeyChain Android App Misleading UI Vulnerability Leading to Privilege Escalation
Summary
CVE-2026-0094: In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. Affects platform/packages/apps/KeyChain across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The KeyChain application is a critical component of the Android ecosystem, responsible for managing cryptographic keys and certificates securely. It provides users with the ability to store and manage their digital certificates, ensuring secure communications and transactions. However, a vulnerability has been identified that could mislead users into granting unauthorized access to these certificates, compromising the security of the application.
Vulnerability Detail
In the KeyChainActivity.java file, the method getApplicationLabel contains a flaw that allows an attacker to trick users into approving access to sensitive certificates. This vulnerability arises from insufficient user interface cues, which can lead to local escalation of privilege without requiring additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to remain vigilant and avoid approving certificate access requests from untrusted sources until the application is updated.
Conclusion
The CVE-2026-0094 vulnerability in the KeyChain application poses a significant risk by allowing unauthorized access to sensitive certificates through misleading UI. Users are strongly encouraged to update their applications to the latest patched versions to mitigate this risk.
See every vulnerability recorded for platform/packages/apps/KeyChain →
FAQ
CVE-2026-0094 is a vulnerability in the KeyChain application on Android that allows attackers to mislead users into granting access to sensitive certificates.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without any signup.
The vulnerability can lead to local privilege escalation, allowing unauthorized access to sensitive certificates without user interaction.
You can update your KeyChain application by downloading the patched version from the official Android repository or using the provided links for direct patches.
While there are no specific workarounds, users should be cautious and avoid approving certificate access requests from untrusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/KeyChain.
