CVE-2026-0134 Google CVE debrief

Who should care

Android system administrators and security teams who need to verify and apply patches, inventory affected systems, and monitor for exploitation. They should review compensating controls for exposed systems, check relevant monitoring, detection, and logs for exposed assets, and track exceptions, retest remediated assets. The issue affects them because it could lead to local information disclosure after a factory reset with no additional execution privileges

Why it matters

CVE-2026-0134 is a medium-severity issue in Android's recovery_ui.cpp that could lead to local information disclosure after a factory reset. Android system administrators and security teams should verify and apply patches, inventory affected systems, and monitor for exploitation. Evidence is limited to official CVE and NVD records.

• Local information disclosure possible

Technical summary

A logic error in PostWipeData of recovery_ui.cpp could lead to local information disclosure after a factory reset with no additional execution privileges needed. This issue affects Android system administrators and security teams. The CVE record and NVD entry provide details on the issue. User interaction is not needed for exploitation. The issue has a medium severity and requires immediate attention. Defenders should verify affected scope and severity. The issue requires verification and application of patches, inventory of affected systems, and monitoring for exploitation.

Defensive priority

Verify and apply patch

Recommended defensive actions

• Verify and apply patch
• Inventory affected systems
• Monitor for exploitation
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the issue. Evidence is limited to official CVE and NVD records. Defenders should verify affected scope, severity, and vendor guidance. The issue affects Android system administrators and security teams. There are no additional execution privileges needed for exploitation. User interaction is not needed for exploitation. The logic error in PostWipeData of recovery_ui.cpp could lead to local information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.