Critical Android Zero-Click Vulnerability Gets PoC Exploit

Key Takeaways

• A critical zero-click vulnerability (CVE-2026-0073) has been discovered in Android’s core system, specifically affecting the adbd daemon.
• The flaw allows nearby attackers to gain full remote shell access without any user interaction, bypassing the wireless ADB authentication mechanism.
• Exploitation requires specific conditions, including enabled Developer options, wireless debugging, a pre-existing trusted RSA host key, and network proximity to the device.
• Android 14, 15, and 16 devices are primarily affected. Google has released a patch in the May 2026 Android Security Bulletin.

A severe zero-click vulnerability has been identified within the foundational Android System, posing a significant threat to mobile device security. Detailed in Google’s May 2026 Android Security Bulletin, this critical flaw could allow malicious actors to compromise devices without any user interaction.

Designated as CVE-2026-0073, the vulnerability resides within Android’s adbd daemon. It enables attackers in close proximity to remotely obtain complete shell access on a target device, effectively circumventing standard security protocols.

Security researchers at BARGHEST are credited with uncovering this critical cryptographic weakness, which fundamentally undermines Android’s debugging trust model. They describe how a tool intended for developers can be weaponized into an undetectable backdoor.

Android Zero-Click PoC Released

The root cause of CVE-2026-0073 is a logical error in the cryptographic handling within the adbd_tls_verify_cert function, located in the auth.cpp file.

Modern wireless ADB connections rely on mutual TLS authentication to ensure that only previously paired and trusted host devices can establish a connection.

During this authentication handshake, the Android system uses the EVP_PKEY_cmp API to compare the public key from the connecting client’s certificate against a list of authorized RSA keys stored on the device.

The vulnerability arises when an attacker presents a certificate that uses a non-RSA algorithm, such as EC P-256 or Ed25519. In such cases, the comparison API correctly returns -1, signaling a cross-algorithm mismatch.

However, due to how the underlying C++ implementation interprets non-zero integers as a boolean success value, the daemon mistakenly validates the attacker’s mismatched certificate as if it were a trusted host key.

While the logical flaw itself is straightforward, its successful exploitation requires precise manipulation of the communication protocol.

An attacker must first establish a TCP connection, successfully negotiate the STLS upgrade sequence, and then supply the specially crafted cross-algorithm certificate.

Once this authentication barrier is bypassed, the attacker can proceed with standard ADB framing within the now-encrypted tunnel to open a remote shell connection.

This grants the attacker execution privileges as the shell user, allowing them to bypass typical application sandboxes and gain elevated access.

With this level of access, threat actors can perform various malicious activities, including extracting sensitive personal information, silently installing harmful applications via package management, and altering system settings to facilitate further exploitation of the device.

According to Barghest Research, the vulnerability primarily impacts Android 14, 15, and 16 devices under specific operational conditions.

Successful exploitation is contingent on several prerequisites:

• Developer options must be actively enabled on the target device.
• Wireless debugging, also known as ADB over TCP, must be exposed on the network.
• The device’s trust store must contain at least one previously paired RSA host key.
• The attacker must have adjacent network reachability to the device’s ADB TCP port 5555.

What You Should Do

• Immediately apply the May 2026 Android security patch to address CVE-2026-0073.
• Disable wireless debugging (ADB over TCP) on all devices, especially when connected to untrusted networks.
• Regularly revoke authorizations for any unknown or unused debugging hosts from your device’s settings.
• Turn off Developer options entirely when not actively in use to significantly reduce the attack surface against automated local network exploitation attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.