Reported by 2 outlets
Android zero-click RCE (CVE-2026-0073) grants remote shell access via adbd
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Android zero-click RCE (CVE-2026-0073) grants remote shell access via adbd
cyberpress.org · 162d ago · May 5th, 2026
Google's May 2026 Android Security Bulletin includes CVE-2026-0073, a critical zero-click remote code execution vulnerability in the Android System component linked to the Android Debug Bridge daemon (adbd) through Project Mainline. The flaw allows attackers within proximity (same network or adjacent communication channels) to gain shell-level access without any user interaction, affecting Android versions 14, 15, 16, and 16 QPR2. While shell access does not provide full root, it exposes sensitive system functions and enables staging of further attacks. Devices running the 2026-05-01 security patch level or later are protected. Organizations managing Android fleets should prioritize patch deployment immediately.
-
update from mobile-hacker.com
Android RCE via Wireless Debugging (CVE-2026-0073) — adjacent-network shell access with no user interaction
mobile-hacker.com · 154d ago · May 13th, 2026
Google has disclosed CVE-2026-0073, a critical authentication bypass in Android's ADB daemon (adbd) TLS certificate verification path. An adjacent attacker on the same Wi-Fi network can bypass the Wireless Debugging pairing requirement and obtain a remote shell as the Android shell user with no user interaction — provided the device has been paired with at least one device in the past. A public PoC exploit is available and has been successfully tested against Android 13-16 devices, tablets, smartwatches, and Google Chromecast TV. Google Pixel devices were not successfully exploited in testing. Patched in security level 2026-05-01. The practical risk is highest for developers, device farms, repair environments, and BYOD engineering fleets that enable Wireless Debugging.