A logic error in Android’s BiometricService onChange method can enable fingerprint unlock without proper authorization. The flaw allows a local user to gain elevated privileges without needing additional privileges or executing arbitrary code. The vulnerability falls under CWE‑285 (Authorization Bypass) and CWE‑693 (Lack of Security Awareness).

The vendor is Google and the product affected is Android version 16.0, including the QPR2 beta releases 1, 2, and 3. The impact applies to all devices running these builds.

The CVSS score of 7.7 indicates high severity, whereas the EPSS score of < 1 % and absence from the KEV catalog suggest a very low current exploitation probability. The likely attack vector is local, inferred from the description: an attacker who can trigger the service’s onChange handler (e.g., through a crafted app or a system component) can activate fingerprint unlock, escalating privilege on the device. No user interaction is required for exploitation based on the description.