CVE-2026-0073 PUBLISHED

Assigner: google_android
Reserved: 15.10.2025 Published: 04.05.2026 Updated: 05.05.2026

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.

Product Status

Vendor Google
Product Android
Versions Default: unaffected
  • Version 16-qpr2 is affected
  • Version 16 is affected
  • Version 15 is affected
  • Version 14 is affected

Credits

  • Ovi (@0x0v1 + Barghest.asia) finder

References

Problem Types

  • Remote code execution