CVE-2026-15432
Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification
CVSS Score
0.0
EPSS Score
0.2%
EPSS Percentile
8th
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
| CWE | CWE-208 |
| Vendor | |
| Product | tink-java |
| Ecosystems | |
| Industries | Technology |
| Published | Jul 21, 2026 |
| Last Updated | Jul 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for google tink-java
Be the first to know when new unknown vulnerabilities affecting google tink-java are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Google / Tink-Java
All releases before 1.21.0, including 1.21.0.
Google / Tink-Android
All releases before 1.21.0, including 1.21.0.