CVE-2026-0073

Name of the Vulnerable Software and Affected Versions Android versions 14 through 16

Description A critical logic error exists in the adbd tls verify cert() function within auth.cpp of the Android Debug Bridge (ADB) daemon (adbd). The issue occurs during wireless ADB mutual authentication when the system compares a stored RSA public key with the key extracted from a client TLS certificate using the EVP PKEY cmp() function. Because EVP PKEY cmp() returns a negative value for incompatible key types (such as EC P-256 or Ed25519) rather than a Boolean, the system evaluates any non-zero return value as true, allowing an attacker to bypass authentication by presenting a non-RSA certificate.

This zero-click flaw allows a remote attacker on the same local network to authenticate as a trusted ADB client without the required private key. Successful exploitation grants remote code execution as the shell user (uid=2000), providing access to system logs, package state information, and the ability to execute commands such as pm, am, settings, and run-as. This can lead to the capture of screenshots, clipboard data, and the injection of fake overlays.

Recommendations Update Android to the May 2026 security patch (2026-05-01 or later). Disable the Wireless debugging feature in Developer options. Restrict access to the adbd daemon by limiting the network interfaces on which it listens.