CVE-2026-0073
Published: 04 May 2026
Description
In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed.…
more
User interaction is not needed for exploitation.
Security SummaryAI
CVE-2026-0073 is a logic error in the adbd_tls_verify_cert function of auth.cpp that enables bypassing mutual authentication for wireless ADB. This vulnerability affects Android components supporting wireless debugging via the Android Debug Bridge (ADB) daemon.
An attacker on an adjacent network can exploit this issue with low attack complexity, no privileges, and no user interaction required. Successful exploitation leads to proximal/adjacent remote code execution as the shell user, with high confidentiality, integrity, and availability impacts (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no additional execution privileges needed.
The Android Security Bulletin provides details on affected versions and patches for mitigation: https://source.android.com/docs/security/bulletin/2026/2026-05-01.
Details
- CWE(s)