Security readout for executives and security teams
Plain-English summary
A logic error in Android notification handling may reveal a contact name that should remain hidden. The issue affects confidentiality only: it does not alter data or disrupt devices. No user action or additional execution privileges are required, but the attacker needs local access.
Executive priority
Treat this as a normal-priority privacy remediation for affected Android fleets, escalating where exposed contact identities would be especially sensitive. It is not supported as an emergency exploitation event, but local disclosure without user interaction warrants timely patch verification.
Technical view
CVE-2026-0012 affects setHideSensitive in ExpandableNotificationRow.java. Incorrect logic can disclose a contact name despite sensitive-content hiding. It is rated CVSS 3.1 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and mapped to CWE-284 and CWE-693.
Likely exposure
The supplied record lists Android 14, 15, and 16. Exposure depends on the device build and installed security updates. The bundle provides no affected build numbers, device models, or patch levels, so administrators must compare devices with Google and manufacturer guidance.
Exploitation context
The attack vector is local, with low complexity, no privileges, and no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or public weaponization. Practical access requirements beyond the CVSS vector are not documented here.
Researcher notes
The flaw is attributed to sensitive-state logic in ExpandableNotificationRow.java. The record indicates high confidentiality impact without integrity or availability impact. The supplied evidence does not identify the faulty condition, affected commits, patch commit, build ranges, disclosure surface, or demonstrated exploit, limiting deeper technical conclusions.
Mitigation direction
- Review Google's March 2026 Android Security Bulletin for the applicable remediation.
- Apply an update explicitly addressing CVE-2026-0012 when provided for each device.
- Obtain model-specific update guidance from device manufacturers or enterprise mobility providers.
- Restrict physical access to sensitive devices until their remediation status is confirmed.
Validation and detection
- Inventory devices running Android 14, 15, or 16.
- Compare each device's build and security patch level with authoritative vendor guidance.
- Confirm deployed updates explicitly include remediation for CVE-2026-0012.
- Verify sensitive-notification behavior no longer exposes contact names on representative devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-693: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0012 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N2.53.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://source.android.com/docs/security/bulletin/2026/2026-03-01CVE reference, google_android · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Protection Mechanism Failure
Protection Mechanism Failure represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.