Loading vulnerability…
Android adbd Wireless Authentication Bypass Leading to Remote Shell Execution
CVE-2026-0073 is a critical authentication-bypass vulnerability in Android's Debug Bridge daemon, adbd, affecting Android 14, 15, 16, and 16-QPR2. The adbd_tls_verify_cert function incorrectly treats any nonzero EVP_PKEY_cmp return value as a successful match between a TLS client certificate key and an authorized RSA host key. Negative results indicating incompatible key types or unsuccessful comparisons are therefore accepted. An attacker presenting a non-RSA client certificate, such as EC P-256 or Ed25519, can bypass wireless ADB mutual authentication when a stored RSA host key exists. Successful exploitation establishes an unauthorized ADB session and permits remote command execution as the Android shell user without user interaction or existing attacker privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality and integrity of resources accessible to Android's shell user and can disrupt device operation through available debugging interfaces. Capabilities can include inspecting logs, processes, packages, and device configuration; accessing shell-readable information; managing packages; changing permitted settings; and accessing debuggable applications through run-as. Impact depends on Android version, OEM policy, permissions, SELinux restrictions, and device configuration. The vulnerability does not independently grant root privileges, kernel execution, unrestricted access to private application data, or access to hardware-backed secrets. Further privilege escalation requires a separate weakness.
If you can’t patch tonight, do this now.
Disable wireless debugging and other network-exposed ADB services when unnecessary, and disable Developer options through device-management policy where appropriate. Where network debugging is required, restrict access to trusted debugging hosts and isolated management networks using firewall rules, segmentation, or client isolation. Prevent external ADB exposure and avoid debugging on untrusted networks. Revoke unknown or unnecessary debugging authorizations. Restrict the actual ADB listening ports rather than relying exclusively on blocking TCP 5555, because wireless debugging can use dynamically assigned ports.
Patch, then assume compromise.
Install the applicable Android security update and verify a security patch level of 2026-05-01 or later, which includes the fix. Apply available Google Play system updates because adbd is also serviced through Project Mainline on supported devices. For affected Samsung devices, install the May 2026 Security Maintenance Release or a superseding update. At the implementation level, key authorization must accept only an explicit successful comparison result of 1 and reject mismatches, incompatible key types, and comparison errors.
17 exploits validated by Mallory's analysis. Hidden: 5 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
74 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.