What’s Vulnerable › Vulnerabilities
CVE-2026-15432: Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-21 · updated 2026-09-22
- Weakness: CWE-208
Description
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
Affected products
- Google LLC Tink: through 1.21.0
References
Get alerted when CVE-2026-15432 or the next vulnerability affects your stack