Android Credential Manager Service Information Disclosure Vulnerability

A permissions bypass vulnerability has been identified in the Credential Manager Service, specifically in the 'updateProvidersWhenServiceRemoved' function. This vulnerability allows for the potential override of settings across different user accounts, leading to unauthorized access to local information. The issue does not require any additional execution privileges or user interaction for exploitation.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information across user accounts.

Remediation

Users can update their devices to the June 2026 security patch level to address this vulnerability.