CVE-2026-0094: In getApplicationLabel of KeyChainActivity

Synopsis

This is a user-interface spoofing vulnerability in Android's KeyChainActivity component, specifically in the getApplicationLabel function. An attacker with a low-privilege local account can display a misleading application label to trick a user into approving certificate access, requiring no additional permissions to pull off. Successful exploitation gives the attacker full read, write, and execution control at a higher privilege level than they started with. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment Google ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no admin or elevated permissions are needed before exploitation.

• Victim interactionNot required

  The CVSS vector specifies UI:N, meaning the exploit does not depend on a user taking any action such as clicking a link or opening a file.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads sensitive certificate data and credentials that the victim app would otherwise have exclusive access to.
• Modifies or injects certificate trust decisions, allowing the attacker to approve their own certificate access under the victim's identity.
• Gains execution privileges at a higher level than the attacker's starting account, enabling further lateral movement within the device.
• Crashes or disrupts the KeyChain service, preventing legitimate apps from completing certificate-dependent operations.