A side‑channel vulnerability in Android’s Trusted Execution Environment can leak cryptographic keys, allowing an attacker to obtain sensitive physical information. The flaw does not require elevated privileges, and does not result in code execution; it simply exposes data that the TEE protects. The official description indicates that exploitation requires some user interaction, implying a local or physical attack context.

All Android devices that deploy the Android operating system with a Trusted Execution Environment, as referenced in the March 2026 Android Security Bulletin. No specific version restrictions are listed; the vulnerability applies to devices covered by the bulletin at the time of disclosure.

The CVSS score of 2.1 signals low severity, and the EPSS score of less than 1% suggests that exploitation is unlikely. The vulnerability is not cataloged in the CISA KEV list. Because the attack requires user interaction, an attacker would need local or physical proximity to the device to mount a side‑channel attack. While the risk to large populations is low, a determined adversary with in‑person access could potentially exploit the side channel to exfiltrate protected data.