Vulnerabilities · 161 days ago

StrongBox Vulnerability Requires Multi-Vendor Coordination for Fixes

A high-severity vulnerability in Android's StrongBox hardware-backed keystore affects implementations from multiple Secure Element vendors including Google, NXP, STMicroelectronics, and Thales. This flaw complicates patching efforts because fixes must be coordinated across different hardware providers. The exact exploit impact remains undisclosed, but StrongBox weaknesses can lead to key extraction, privilege escalation, or denial-of-service. Additionally, a local denial-of-service vulnerability in the Android Framework (CVE-2026-0049) was patched, exploitable without special privileges or user interaction. Neither vulnerability shows signs of active exploitation yet. The multi-vendor nature of the StrongBox flaw signals ongoing challenges in securing hardware-backed key storage across diverse supply chains.

CVE-2026-0049

NVD KEV

CVSS 6.2 MEDIUM: in onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. EPSS 0.1% (1st percentile).

CVE-2025-48651

NVD KEV

Timeline

Apr 7 Reported by SecurityWeek

Sources

1 source covering this story

SecurityWeek Apr 7
Severe StrongBox Vulnerability Patched in Android
A critical DoS vulnerability in the Framework component of Android has also been fixed with the latest update.

Entities

CVE-2026-0049
CVE-2025-48651

Part of the PlainSec briefing for 2026-04-08

Editions

Briefing for 2026-04-08

Vulnerabilities · 161 days agoStrongBox Vulnerability Requires Multi-Vendor Coordination for FixesA high-severity vulnerability in Android's StrongBox hardware-backed keystore affects implementations from multiple Secure Element vendors including Google, NXP, STMicroelectronics, and Thales. This flaw complicates patching efforts because fixes must be coordinated across different hardware providers. The exact exploit impact remains undisclosed, but StrongBox weaknesses can lead to key extraction, privilege escalation, or denial-of-service. Additionally, a local denial-of-service vulnerability in the Android Framework (CVE-2026-0049) was patched, exploitable without special privileges or user interaction. Neither vulnerability shows signs of active exploitation yet. The multi-vendor nature of the StrongBox flaw signals ongoing challenges in securing hardware-backed key storage across diverse supply chains.

CVE-2026-0049

NVD KEV

CVSS 6.2 MEDIUM: in onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. EPSS 0.1% (1st percentile).