CVE-2026-0016
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
A local attacker could override settings of other users, potentially leading to disclosure of sensitive information or violation of user isolation.
Recommendation
Apply the system patch that fixes the permission control in CredentialManagerService.java.
Original NVD description (English source)
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.