CVE-2026-15432— Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification
Possible ATT&CK Techniques 1AI
T1557.002 · ARP Cache PoisoningAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Tink-Android | All releases before 1.21.0, including 1.21.0. | affected | |
| Tink-Java | All releases before 1.21.0, including 1.21.0. | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15432
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification
Source: CVE Program / CVE List V5
Vulnerability Description
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Tink-Java | All releases before 1.21.0, including 1.21.0. | - | ||
| Tink-Android | All releases before 1.21.0, including 1.21.0. | - |
II. Public POCs for CVE-2026-15432
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15432
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-15432 (1)
Same Patch Batch · Google · 2026-07-21 · 14 CVEs total
| CVE-2026-16423 | Google Chrome 资源管理错误漏洞 | |
| CVE-2026-16424 | Google Chrome 资源管理错误漏洞 | |
| CVE-2026-16418 | Google Chrome 缓冲区错误漏洞 | |
| CVE-2026-16422 | Google Chrome 输入验证错误漏洞 | |
| CVE-2026-16419 | Google Chrome 安全漏洞 | |
| CVE-2026-16417 | Google Chrome 异常处理不当漏洞 | |
| CVE-2026-16415 | Google Chrome 输入验证错误漏洞 | |
| CVE-2026-16416 | Google Chrome 数字错误漏洞 | |
| CVE-2026-16414 | Google Chrome 输入验证错误漏洞 | |
| CVE-2026-16413 | Google Chrome 缓冲区错误漏洞 | |
| CVE-2026-16421 | Google Chrome 安全漏洞 | |
| CVE-2026-16420 | Google Chrome 缓冲区错误漏洞 | |
| CVE-2026-15829 | SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox |
IV. Related Vulnerabilities
Same weakness: CWE-208
- CVE-2026-13183
RadAsyncUpload Upload Metadata Timing Oracle Vulnerability i - CVE-2026-54685
FileBrowser Quantum has Username Enumeration via Authenticat - CVE-2026-6656
Crypt::Password versions through 0.28 for Perl are susceptib - CVE-2026-9537
Mojo::JWT versions before 1.02 for Perl verify HMAC signatur - CVE-2026-56764
Hono - Timing Attack in basicAuth and bearerAuth Middleware
V. Comments for CVE-2026-15432
No comments yet