Android Biometric Unlock Privilege Escalation Vulnerability

A vulnerability in the FaceSettings component of the Android Settings app allows for the removal of biometric unlock across user profiles. This issue arises from improper input validation, which could lead to local escalation of privilege without requiring additional execution privileges. Exploitation of this vulnerability does not need user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized access to features or data that require elevated privileges, potentially allowing a user to manipulate system settings or access restricted information.

Reproduction

The vulnerability can be reproduced by a user with a non-zero user ID. This can be done by using the Android Debug Bridge (ADB) to start the Face Settings activity for the specified user.

Remediation

Users can update their devices to the September 2025 security patch level to address this vulnerability.