CVE-2026-0134: Low severity Google Android Recovery vulnerability
In PostWipeData of recoveryui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Fix the logic error in PostWipeData in recovery_ui.cpp so that a factory reset actually removes local user data; apply the corrected code to affected builds and verify through testing that no data persists after a factory reset.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0134?
The severity of CVE-2026-0134 is rated as low with a score of 3.3.
What is CVE-2026-0134 about?
CVE-2026-0134 addresses a possible data persistence issue in PostWipeData of recovery_ui.cpp after a factory reset.
How does CVE-2026-0134 impact users?
CVE-2026-0134 could potentially lead to local information disclosure without requiring additional execution privileges.
What type of attack vector does CVE-2026-0134 use?
CVE-2026-0134 utilizes a logic error in the code, allowing the exploitation to occur without user interaction.
How can I mitigate CVE-2026-0134?
Mitigation for CVE-2026-0134 involves updating to the latest version of Google Android that addresses this vulnerability.