Vulnerability · Published Jul 21, 2026 · Assigned by Google
CVE-2026-15432Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification
High 8.2
In plain English
A high-severity security flaw in Tink-Android from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.2%top 92.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tink-Java | All releases before 1.21.0, including 1.21.0. | |
| Tink-Android | All releases before 1.21.0, including 1.21.0. |
Weakness: CWE-208 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N