In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
|
No data.
References
History
Fri, 10 Apr 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:o:google:android:-:*:*:*:*:*:*:* | |
| Metrics |
cvssV3_1
|
Thu, 09 Apr 2026 08:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Local Information Disclosure via Improper Input Validation in Android Keymaster Applet | |
| Weaknesses | CWE-20 CWE-200 |
Wed, 08 Apr 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | StrongBox Key Management Vulnerability | |
| Weaknesses | CWE-200 CWE-285 |
Wed, 08 Apr 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | StrongBox in Android before security patch level 2026-04-05 has a vulnerability of High Severity, aka A-434039170, A-467765081, A-467765894, and A-467762899. | In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
Tue, 07 Apr 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 07 Apr 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Google
Google android |
|
| Vendors & Products |
Google
Google android |
Tue, 07 Apr 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | StrongBox Key Management Vulnerability | |
| Weaknesses | CWE-200 CWE-285 |
Mon, 06 Apr 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | StrongBox in Android before security patch level 2026-04-05 has a vulnerability of High Severity, aka A-434039170, A-467765081, A-467765894, and A-467762899. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: google_android
Published: 2026-04-06T18:20:31.044Z
Updated: 2026-04-08T17:23:37.800Z
Reserved: 2025-05-22T18:12:46.995Z
Link: CVE-2025-48651
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2026-04-06T19:16:25.867
Modified: 2026-04-10T18:56:17.807
Link: CVE-2025-48651
Redhat
No data.