---
id: CVE-2026-0094
title: >-
  In getApplicationLabel of KeyChainActivity.java, there is a possible way to
  trick the user into approving access to certificates due to misleading or
  insufficient UI
summary: >-
  In getApplicationLabel of KeyChainActivity.java, there is a possible way to
  trick the user into approving access to certificates due to misleading or
  insufficient UI. This could lead to local escalation of privilege with no
  additional ex…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-451
vendor: google
product: android
affected:
  - android = 14.0
  - android = 15.0
  - android = 16.0
published: '2026-06-01'
updated: '2026-07-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0094'
references:
  - url: 'https://source.android.com/docs/security/bulletin/2026/2026-06-01'
    label: security@android.com
tags:
  - nvd
epss: 0.00058
epssPercentile: 0.00008
ingestedAt: '2026-07-23T08:15:14.555Z'
---

## Overview

In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

## Affected

- `android = 14.0`
- `android = 15.0`
- `android = 16.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.