VulnSocial
← Back to blog

CVE-2026-0073 – Critical Zero‑Click Remote Code Execution in Android ADB

On May 1 2026, Google released a security update that patches a Critical remote code execution vulnerability (CVE-2026-0073) affecting the Android Debug Bridge daemon (adbd) when used over TCP (wireless debugging). The flaw allows an unauthenticated attacker on the same local network or in physical proximity to obtain a shell as the Android “shell” user without any user interaction.

Key takeaways

  • CVE-2026-0073 is a Critical remote code execution flaw in the Android ADB daemon (adbd) over TCP.
  • Exploits require only network proximity; no taps, downloads, or user interaction.
  • Affected devices: Android 14, 15, 16 (including 16‑QPR2) with wireless debugging enabled.
  • Patch is available in the May 2026 Android security bulletin and in downstream OS builds (e.g., GrapheneOS March 2026 preview).
  • Immediate actions: apply the latest OTA update, disable wireless debugging if not needed, and enforce patch compliance via MDM.

Overview

  • Vulnerability ID: CVE-2026-0073
  • Vendor: Google
  • Product: Android (system component adbd)
  • Published: 2026‑05‑04 (NVD), security bulletin 2026‑05‑01
  • CISA KEV: Not listed (CISA KEV = false)

Technical Details

The flaw resides in the function adbd_tls_verify_cert within auth.cpp. Wireless debugging uses TLS client‑certificate authentication to verify that the connecting host is authorized. A logic error in the verification routine allows an attacker to bypass the certificate check, effectively granting unauthenticated access to the ADB daemon over TCP.

Key points:

  • Attack vector: Adjacent network (AV:A) – attacker must be on the same Wi‑Fi or LAN segment.
  • Privileges required: None (PR:N). The exploit runs as the Android “shell” user.
  • User interaction: None (UI:N). No taps, clicks, or app installations.
  • Impact: Full command execution (C:H/I:H/A:H). The attacker can read/write files, capture screenshots, read the clipboard, and launch overlay attacks.

The vulnerability is triggered when wireless debugging is enabled via developer options. By default, wireless debugging is disabled after a reboot, limiting exposure, but devices that keep it enabled remain vulnerable until patched.

Severity & Impact

  • CVSS v3.1: 8.8 (Severity: High)
  • Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CWE: CWE-303 – Authentication Bypass
  • Active exploitation: None reported in the wild; however, public PoCs have been released and the signal volume spiked after the May 2026 bulletin.

Affected Products

  • Android 14.0
  • Android 15.0
  • Android 16.0 (including QPR2 beta releases)

For the complete list of affected builds and versions, see the live CVE page: https://vulnsocial.com/cve/CVE-2026-0073.

Actionable Insights / What to Do

  1. Update every Android device to the latest security patch (May 2026 or later). The patch is delivered via OTA updates.
  2. Disable wireless debugging if it is not required for your workflow. This can be done in Developer options → Wireless debugging → Off.
  3. Turn off Developer options on production devices. This removes the ability to enable wireless debugging without a reboot.
  4. Enforce patch compliance through Mobile Device Management (MDM) or enterprise EMM solutions. Verify that devices report the security patch level ≥ 2026‑05‑01.
  5. Monitor network traffic for unexpected ADB‑over‑TCP connections (default port 5555). Use IDS/IPS signatures to alert on such activity.
  6. Audit logs on devices that require wireless debugging for suspicious commands executed by the “shell” user.

Remediation & Mitigation

  1. Apply the OTA update released in the May 2026 Android security bulletin. This patch fixes the logic error in adbd_tls_verify_cert.
  2. Verify the patch by checking the build fingerprint or security patch level: 
    adb shell getprop ro.build.version.security_patch
    The output should be 2026-05-01 or later.
  3. If you cannot update immediately, disable wireless debugging and developer options as a temporary mitigation.
  4. For enterprise fleets, push a configuration policy that disables wireless debugging by default and requires a reboot after any change.
  5. Continuously monitor the VulnSocial CVE page for any emerging exploit activity or new advisory updates: https://vulnsocial.com/cve/CVE-2026-0073.

Bottom Line

CVE-2026-0073 is a Critical zero‑click RCE affecting the core Android ADB daemon. The vulnerability can be fully mitigated by applying the May 2026 security patch and disabling wireless debugging when not needed.

References

#CVE #Critical #RCE #Android #CVE20260073