Google Patches Android Zero-Interaction DoS and Zero-Click adbd RCE Flaws

Google issued Android security updates to fix multiple high-severity flaws, including CVE-2026-0049, a critical Android Framework vulnerability that can trigger a local denial-of-service with no user interaction and no elevated privileges, and CVE-2026-0073, a critical remote code execution bug in the Android System component tied to the Android Debug Bridge Daemon (adbd). The adbd flaw affects Android 14, 15, 16, and 16-qpr2, and under proximal or adjacent network conditions could allow shell-level remote code execution on a target device without user action.

The April bulletin also addressed CVE-2025-48651, a high-severity StrongBox issue affecting hardware-backed key storage implementations from Google, NXP, STMicroelectronics, and Thales, with fixes split between the 2026-04-01 and 2026-04-05 patch levels. Google said the adbd issue is remediated by the 2026-05-01 security patch level or later and noted that, because adbd is delivered through Project Mainline, mitigations can reach Android 10 and later devices faster through Google Play system updates; organizations were urged to accelerate deployment of the April and May patches across managed mobile fleets.