{"id":"ASB-A-471173239","details":"In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-471173239","CVE-2026-0094"],"modified":"2026-06-24T15:00:40.818157658Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/b8d3fe7c5e4b3b637c37c77fa31a026b3bf03818"}],"affected":[{"package":{"name":"platform/packages/apps/KeyChain","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/KeyChain/+/63b405131fb57386e4157218c124813952267bc6"],"spl":"2026-06-01","severity":"High","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/keychain/KeyChainActivity.java"},"source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/63b405131fb57386e4157218c124813952267bc6","signature_version":"v1","signature_type":"Line","id":"ASB-A-471173239-8f4618ba","digest":{"line_hashes":["26687373485879391662561325096342427190","10564120794107447998862692671314800852","334786948668186791478667143733520750042","195454848540004563348757865935509402405","259441048041282786093793524702039661347","107820713247193742428586680493675422330","293227346220967011805556519508892492054","128544837652075124560358436014501237450","317048380878952574016295194129660067147","294065243487837461116566329224669477416","253516173234571607432916551470524949743","36981083390145988513535660273564440671","123880397416625023861882326713496867314","200867467935981279924066975327163370854","167851226727725959219140596888092811555","132044811077109378497839070930778047943","334117210891919007265941916267990304455"],"threshold":0.9},"deprecated":false},{"target":{"file":"src/com/android/keychain/KeyChainActivity.java","function":"getApplicationLabel"},"source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/63b405131fb57386e4157218c124813952267bc6","signature_version":"v1","signature_type":"Function","id":"ASB-A-471173239-f3e6d939","digest":{"length":216,"function_hash":"278906053347869451486875652198283524472"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471173239.json"}},{"package":{"name":"platform/packages/apps/KeyChain","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/KeyChain/+/7a734d424c21f937601b89bae1dc90e07e27de03"],"vanir_signatures":[{"target":{"file":"src/com/android/keychain/KeyChainActivity.java","function":"getApplicationLabel"},"source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/7a734d424c21f937601b89bae1dc90e07e27de03","signature_version":"v1","signature_type":"Function","id":"ASB-A-471173239-c947540e","digest":{"length":216,"function_hash":"278906053347869451486875652198283524472"},"deprecated":false},{"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/7a734d424c21f937601b89bae1dc90e07e27de03","target":{"file":"src/com/android/keychain/KeyChainActivity.java"},"deprecated":false,"id":"ASB-A-471173239-e82da58d","digest":{"line_hashes":["26687373485879391662561325096342427190","10564120794107447998862692671314800852","334786948668186791478667143733520750042","195454848540004563348757865935509402405","259441048041282786093793524702039661347","107820713247193742428586680493675422330","293227346220967011805556519508892492054","128544837652075124560358436014501237450","317048380878952574016295194129660067147","294065243487837461116566329224669477416","253516173234571607432916551470524949743","36981083390145988513535660273564440671","123880397416625023861882326713496867314","200867467935981279924066975327163370854","167851226727725959219140596888092811555","132044811077109378497839070930778047943","334117210891919007265941916267990304455"],"threshold":0.9},"signature_version":"v1"}],"types":["EoP"],"spl":"2026-06-01","severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471173239.json"}},{"package":{"name":"platform/packages/apps/KeyChain","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/KeyChain/+/fcf77cbf5b240d8b82767b1d510c792510c923b4"],"vanir_signatures":[{"target":{"file":"src/com/android/keychain/KeyChainActivity.java","function":"getApplicationLabel"},"source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/fcf77cbf5b240d8b82767b1d510c792510c923b4","signature_version":"v1","signature_type":"Function","id":"ASB-A-471173239-81d66a41","digest":{"length":216,"function_hash":"278906053347869451486875652198283524472"},"deprecated":false},{"target":{"file":"src/com/android/keychain/KeyChainActivity.java"},"source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/fcf77cbf5b240d8b82767b1d510c792510c923b4","signature_version":"v1","signature_type":"Line","id":"ASB-A-471173239-b6a77adb","digest":{"line_hashes":["26687373485879391662561325096342427190","10564120794107447998862692671314800852","334786948668186791478667143733520750042","195454848540004563348757865935509402405","259441048041282786093793524702039661347","107820713247193742428586680493675422330","293227346220967011805556519508892492054","128544837652075124560358436014501237450","317048380878952574016295194129660067147","294065243487837461116566329224669477416","253516173234571607432916551470524949743","36981083390145988513535660273564440671","123880397416625023861882326713496867314","200867467935981279924066975327163370854","167851226727725959219140596888092811555","132044811077109378497839070930778047943","334117210891919007265941916267990304455"],"threshold":0.9},"deprecated":false}],"types":["EoP"],"spl":"2026-06-01","severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471173239.json"}},{"package":{"name":"platform/packages/apps/KeyChain","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/KeyChain/+/a87784d5b7780b9f821431131a99ce59906ef6e8"],"spl":"2026-06-01","severity":"High","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/keychain/KeyChainActivity.java"},"source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/a87784d5b7780b9f821431131a99ce59906ef6e8","signature_version":"v1","signature_type":"Line","id":"ASB-A-471173239-aa357ca4","digest":{"line_hashes":["26687373485879391662561325096342427190","10564120794107447998862692671314800852","334786948668186791478667143733520750042","195454848540004563348757865935509402405","259441048041282786093793524702039661347","107820713247193742428586680493675422330","293227346220967011805556519508892492054","128544837652075124560358436014501237450","317048380878952574016295194129660067147","294065243487837461116566329224669477416","253516173234571607432916551470524949743","36981083390145988513535660273564440671","123880397416625023861882326713496867314","200867467935981279924066975327163370854","167851226727725959219140596888092811555","132044811077109378497839070930778047943","334117210891919007265941916267990304455"],"threshold":0.9},"deprecated":false},{"target":{"file":"src/com/android/keychain/KeyChainActivity.java","function":"getApplicationLabel"},"source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/a87784d5b7780b9f821431131a99ce59906ef6e8","signature_version":"v1","deprecated":false,"id":"ASB-A-471173239-c33a69c7","digest":{"length":216,"function_hash":"278906053347869451486875652198283524472"},"signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471173239.json"}},{"package":{"name":"platform/packages/apps/KeyChain","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/KeyChain/+/4be5fc7cab669c6e9a2100a1b9ad0c6c0ced6955"],"spl":"2026-06-01","severity":"High","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/4be5fc7cab669c6e9a2100a1b9ad0c6c0ced6955","target":{"file":"src/com/android/keychain/KeyChainActivity.java"},"deprecated":false,"id":"ASB-A-471173239-249fac11","digest":{"line_hashes":["26687373485879391662561325096342427190","10564120794107447998862692671314800852","334786948668186791478667143733520750042","195454848540004563348757865935509402405","259441048041282786093793524702039661347","107820713247193742428586680493675422330","293227346220967011805556519508892492054","128544837652075124560358436014501237450","317048380878952574016295194129660067147","294065243487837461116566329224669477416","253516173234571607432916551470524949743","36981083390145988513535660273564440671","123880397416625023861882326713496867314","200867467935981279924066975327163370854","167851226727725959219140596888092811555","132044811077109378497839070930778047943","334117210891919007265941916267990304455"],"threshold":0.9},"signature_version":"v1"},{"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/apps/KeyChain/+/4be5fc7cab669c6e9a2100a1b9ad0c6c0ced6955","target":{"file":"src/com/android/keychain/KeyChainActivity.java","function":"getApplicationLabel"},"deprecated":false,"id":"ASB-A-471173239-df09e297","digest":{"length":216,"function_hash":"278906053347869451486875652198283524472"},"signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-471173239.json"}}],"schema_version":"1.7.5"}