CVE-2026-54318

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2026.5.3

Description The LocationSensorManager BroadcastReceiver is exported without requiring permissions. This allows any installed application on the device, even those without runtime permissions, to send a forged Google Play Services LocationResult directly to the receiver. Because the receiver trusts this data, it forwards the spoofed location to the Home Assistant server as the actual device position. This process bypasses the Android developer-mode Mock Location security gate, enabling a malicious local app to trigger zone-based automations, such as unlocking doors, disarming alarms, or opening garages, by faking the user's GPS coordinates.

Recommendations Update to version 2026.5.3.