A critical race condition in Google Android versions 14 and 15 permits an unauthenticated attacker to bypass the lockscreen and escalate privileges locally.

This vulnerability is a race condition affecting the lockscreen mechanism. It allows a local attacker to achieve an elevation of privilege without requiring additional execution permissions or user interaction.

The ability to bypass the lockscreen on mobile devices represents a significant security failure, as it grants unauthorized access to protected data and system functions. With a CVSS score of 7.4, this high-severity flaw exposes organizational assets to potential data exfiltration and unauthorized device control, undermining the fundamental security posture of managed mobile endpoints.

Immediate Action: Apply the relevant security updates provided in the March 2026 Android Security Bulletin as soon as they are made available for your specific device model.

Proactive Monitoring: Security teams should monitor device management logs for unusual login patterns or evidence of failed authentication attempts that precede successful access.

Compensating Controls: Enforce device management policies that restrict physical access to hardware and utilize disk encryption to protect data in the event of a physical compromise.

Public Exploit Available: Unknown

Given the potential for unauthorized access to sensitive information, organizations must prioritize the deployment of the March 2026 security patch across all managed Android 14 and 15 devices. Administrators should coordinate with mobile device management (MDM) providers to ensure that these updates are pushed to end-user devices immediately upon release to mitigate the risk of local privilege escalation.