Description
In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Android | Android SoC | — |
Advisories 3
- WID-SEC-2026-3251 Android Patchday September 2026: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- WID-SEC-2026-0974 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- WID-SEC-2026-0973 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 6, 2026