A critical logic flaw in the Android BiometricService allows unauthorized users to bypass fingerprint authentication, posing a severe risk of local privilege escalation.

The vulnerability exists within the onChange function of BiometricService.java, where a logic error permits fingerprint unlock functionality to be enabled by an unauthenticated local attacker.

The ability to bypass biometric security controls on a mobile device allows an attacker to gain unauthorized access to sensitive user data and installed applications. Given the CVSS score of 7.7, this vulnerability represents a high-severity risk to device integrity and confidentiality. Organizations utilizing affected Android devices for business operations face significant exposure to data breaches if these devices are physically accessed by malicious actors.

Immediate Action: Apply the official security updates provided by Google or the specific device manufacturer as documented in the March 2026 Android Security Bulletin.

Proactive Monitoring: Monitor system logs for unauthorized authentication events or unusual biometric service behavior that may indicate exploitation attempts.

Compensating Controls: Ensure device-level encryption is active and implement secondary authentication requirements for highly sensitive corporate applications to mitigate the impact of a biometric bypass.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention, particularly for mobile fleets handling sensitive enterprise information. Administrators should prioritize the deployment of the March 2026 security patches to all affected Android devices to close this local privilege escalation path.