A critical local privilege escalation vulnerability in Google Android allows unauthenticated attackers to bypass the lockscreen and access device data.

The vulnerability resides in multiple functions within KeyguardViewMediator.java, where a logic error facilitates a lockscreen bypass. This flaw allows for local escalation of privilege without requiring prior authentication or user interaction.

The ability to bypass the lockscreen on mobile devices poses a severe risk to data confidentiality and integrity. If exploited, an attacker with physical access to a device could gain unauthorized access to sensitive corporate information, communications, and stored credentials, potentially leading to a significant security breach or loss of control over the device. Given the CVSS score of 8.4, this vulnerability is classified as high severity, reflecting the potential for full access to the device contents.

Immediate Action: Organizations should monitor the official Google Android Security Bulletin for the March 2026 update and deploy the corresponding patches to all managed devices as soon as they become available.

Proactive Monitoring: Security teams should monitor device logs for unusual authentication behavior or unauthorized attempts to access protected system functions.

Compensating Controls: Ensure that full disk encryption and secondary application-level authentication (such as secure containers or managed work profiles) are enforced to provide defense in depth while awaiting the system-level patch.

Public Exploit Available: No (exploit_available: false).

This vulnerability represents a significant risk to the security of Android devices within the enterprise. Administrators must prioritize the deployment of the March 2026 security updates across all affected versions of Android to mitigate the risk of unauthorized access. Failure to address this issue promptly could lead to the compromise of sensitive data stored on mobile hardware.