[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwY6Y7mI7mCuAyPNQ-pgVONXEDXQXWMW0MMFneZddpTI":3},{"article":4,"iocs":44,"watch_terms":52,"solutions":53,"lesson":119},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"db8f60cd-6cad-4090-8e8a-b381aa3cd158","Severe StrongBox Vulnerability Patched in Android","severe-strongbox-vulnerability-patched-in-android","A critical DoS vulnerability in the Framework component of Android has also been fixed with the latest update. The post Severe StrongBox Vulnerability Patched in Android appeared first on SecurityWeek.","Google released Android security updates addressing two vulnerabilities: CVE-2026-0049, a critical denial-of-service flaw in Android's Framework component exploitable by local attackers without privileges, and CVE-2025-48651, a high-severity vulnerability in StrongBox (Android's hardware-backed secure keystore) affecting implementations from Google, NXP, STMicroelectronics, and Thales. Neither vulnerability has been exploited in the wild, though technical details of the StrongBox flaw remain undisclosed.","Android security updates patch critical DoS flaw and high-severity StrongBox keystore vulnerability.","https:\u002F\u002Fwww.securityweek.com\u002Fsevere-strongbox-vulnerability-patched-in-android\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F02\u002FAndroid-update.jpeg","2026-04-07T14:23:51+00:00","2026-04-07T16:00:23.835276+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Android","product",{"name":21,"type":19},"StrongBox",{"name":23,"type":24},"Google","vendor",{"name":26,"type":24},"NXP",{"name":28,"type":24},"STMicroelectronics",{"name":30,"type":24},"Thales","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-0049","Critical denial-of-service vulnerability in Android Framework component",{"type":46,"value":50,"context":51},"CVE-2025-48651","High-severity vulnerability in Android StrongBox secure keystore",[23,26,28],{"controls":54,"vendors":111},[55,83],{"slug":56,"name":57,"problem":58,"products":59},"patch-management","Automated patch management","Known holes get closed in days, not months.",[60,67,75],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":56,"product_name":64,"url":65,"description":66},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":84,"name":85,"problem":86,"products":87},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":105,"vendor_name":30,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[112,117],{"slug":113,"name":23,"logo_path":114,"roles":115},"google","\u002Fvendor-logos\u002Fgoogle.png",[116],"affected",{"slug":105,"name":30,"logo_path":106,"roles":118},[116],{"slug":120,"title":121,"body":122,"framework_refs":123,"framework_notes":129},"critical-android-strongbox-vulnerabilities-highlight-mobile-security-risks","Critical Android StrongBox Vulnerabilities Highlight Mobile Security Risks","Google addressed two significant Android vulnerabilities: a critical denial-of-service flaw exploitable by local attackers without privileges, and a high-severity vulnerability in StrongBox, Android's hardware-backed secure keystore. The StrongBox vulnerability is particularly concerning as it affects the hardware security module responsible for protecting cryptographic keys and sensitive data across multiple vendor implementations. While neither vulnerability has been exploited in the wild, the combination of privilege escalation potential and hardware security bypass demonstrates the critical importance of timely mobile device patching. Organizations must recognize that mobile devices contain the same sensitive data as traditional endpoints and require equivalent security management.",[124,125,126,127,128],"CIS Control 7","NIST CM-8","NIST SI-2","ISO 27001 A.12.6.1","NIST SP 800-124",{}]