Security readout for executives and security teams
Plain-English summary
A flaw in Android face-enrollment code may let a locally positioned attacker abuse trusted functionality and gain elevated privileges. Exploitation requires no existing privileges or user interaction and could compromise device confidentiality, integrity, and availability. The supplied evidence does not identify affected device models or confirm exploitation in the wild.
Executive priority
Treat this as a high-priority Android endpoint issue because successful exploitation could provide broad device compromise without user interaction. Direct immediate attention to exposed or sensitive Android 16 devices, while confirming exact affected builds through Google and manufacturer guidance. There is no supplied evidence of active exploitation requiring emergency incident response.
Technical view
Multiple functions in FaceEnroll.kt contain a confused-deputy weakness (CWE-441). The CVSS 3.1 assessment is 8.4: local access, low complexity, no privileges, and no user interaction, with high confidentiality, integrity, and availability impact. The bundle names Android 16 and 16-qpr2, but its default-status metadata is ambiguous and requires vendor-bulletin confirmation.
Likely exposure
Potential exposure is limited to devices running relevant Android 16 or 16-qpr2 builds containing the vulnerable face-enrollment component. The bundle provides no affected build numbers, security patch levels, hardware scope, or enabling conditions. Confirm exposure against Google's September 2026 Android Security Bulletin rather than treating every Android 16 device as vulnerable.
Exploitation context
The attack vector is local, so this is not described as directly remotely exploitable. No prior privileges or user interaction are required. The supplied record is not marked as CISA KEV, and no cited evidence confirms active exploitation, public exploit availability, or observed campaigns.
Researcher notes
The record identifies FaceEnroll.kt and confused-deputy behavior but provides no vulnerable call paths, component package, affected commits, patch identifiers, or fixed versions. The affected-version listing and defaultStatus of unaffected appear difficult to reconcile without the vendor bulletin. Avoid inferring biometric bypass specifically; the documented outcome is local privilege escalation.
Mitigation direction
- Review Google's September 2026 Android Security Bulletin for affected builds and prescribed remediation.
- Apply Google or device-manufacturer security updates addressing CVE-2026-0008 when available.
- Prioritize managed, privileged, shared, or physically exposed Android 16 devices.
- Use normal device-access controls while updates are pending; these do not replace vendor remediation.
Validation and detection
- Inventory Android 16 and 16-qpr2 devices, including build numbers and security patch levels.
- Compare each device against Google's bulletin and manufacturer-specific update guidance.
- Confirm remediated devices report the expected build and security patch level after updating.
- Document devices lacking vendor confirmation or available updates as unresolved exposure.
- Monitor vendor and CVE records for revised scope or exploitation evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-441: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0008 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/docs/security/bulletin/2026/2026-09-01CVE reference, google_android
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unintended Proxy or Intermediary ('Confused Deputy')
Unintended Proxy or Intermediary ('Confused Deputy') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.