CVE-2026-45520: Elevation of privilege in Google Android

The vulnerability CVE-2026-45520 exists in the onAttach method of BiometricsSettingsBase.java in Google Android. It involves a confused deputy problem that allows an attacker to bypass authentication checks, resulting in local elevation of privilege. No user interaction is required for exploitation, and the attacker does not need extra execution privileges to exploit this flaw. The CVSS v3.1 base score is 7.8, indicating a high severity with impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows a local attacker to escalate privileges on the affected Android device, potentially gaining higher access rights than intended. This can compromise the confidentiality, integrity, and availability of the system. No user interaction is required, increasing the risk of exploitation in local attack scenarios.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the official Google Android security advisories for current remediation guidance. Until a fix is available, restrict local access to trusted users and monitor for suspicious activity related to biometric settings.