CVE-2026-0073: Critical Android RCE Flaw Affects Android 14 Through 16

Google's May 2026 Android Security Bulletin patches CVE-2026-0073 (rated Critical), a Remote Code Execution (RCE — the ability for an attacker to run arbitrary commands on a target device) flaw in Android's System component. The vulnerability requires no user interaction and affects every supported Android major release: Android 14, 15, 16, and 16-QPR2. Devices not yet updated to the 2026-05-01 security patch level remain exposed.

CVE-2026-0073: Technical Details

CVE-2026-0073 (a critical authentication-logic flaw in Android's debug bridge daemon, allowing unauthenticated adjacent-network code execution) resides in the adbd_tls_verify_cert function inside auth.cpp, the certificate verification routine used by Android Debug Bridge (ADB — a developer and diagnostic tool that enables communication between a host computer and an Android device, including via wireless connections). The bug is a logic error that allows an attacker to bypass ADB's mutual TLS (Transport Layer Security — the cryptographic protocol that Android uses to verify both ends of a wireless ADB connection) authentication entirely.

According to Google's May 2026 Android Security Bulletin, the attack vector is classified as proximal/adjacent — meaning an attacker must be on the same local Wi-Fi network or within Bluetooth range of the target device. No user interaction is required. Successful exploitation grants the attacker code execution at the privilege level of the shell user, which is a highly capable account on Android that can:

• Execute system-level commands outside the normal app sandbox
• Read application data across installed apps on many device configurations
• Issue am (Activity Manager) and pm (Package Manager) commands to install, launch, or kill applications
• Access device sensors, camera, and microphone through shell-accessible APIs

CVE-2026-0073 appears in the Project Mainline delivery path, which means Google can ship the fix as an automatic system module update independent of device manufacturers, significantly accelerating patch delivery to end users — though that update still requires device connectivity and in some cases user acknowledgement.

Affected Versions

The vulnerability affects the following Android releases as shipped:

• Android 14 (all subversions)
• Android 15 (all subversions)
• Android 16 (all subversions)
• Android 16-QPR2 (all subversions)

Earlier Android versions, which are no longer under active support from Google, are not listed in the bulletin — not because they are unaffected, but because they no longer receive security updates at all. Devices running Android 13 or earlier have no patch path and remain permanently exposed to any version of this bug class if wireless ADB is enabled.

Exploitation Status and Threat Landscape

As of publication, Google has not indicated that CVE-2026-0073 is under active exploitation in the wild. CVE-2026-0073 does not appear on the CISA Known Exploited Vulnerabilities catalog (KEV — a list maintained by the U.S. Cybersecurity and Infrastructure Security Agency that confirms which flaws are actively being used in real-world attacks). No public Proof-of-Concept (PoC — working exploit code published publicly) exploit code has been confirmed at time of writing.

However, the zero-click (no user interaction), adjacent-network exploitation path is a high-value capability for several threat actor classes:

• Enterprise attackers who have already gained a foothold on a corporate Wi-Fi segment and want to pivot to employee mobile devices
• Physical-proximity actors in targeted-intrusion scenarios — airports, conference venues, co-working spaces
• State-sponsored groups whose tooling frequently targets mobile platforms for espionage

The adjacent-network requirement does limit the realistic attack surface compared to a fully remote (internet-routable) exploit, but in enterprise environments where employees share wireless segments with untrusted devices, this boundary is thin.

Who Is Affected

Any Android device running Android 14, 15, 16, or 16-QPR2 that has not yet received the 2026-05-01 security patch level is vulnerable. This spans:

• Consumer smartphones and tablets from Samsung, Google, OnePlus, Xiaomi, and virtually every Android OEM
• Android-based enterprise endpoint devices (point-of-sale, industrial HMIs running AOSP builds)
• Android-based kiosk and digital signage deployments

The question of when a specific device receives the patch depends entirely on the manufacturer and carrier. Google Pixel devices receive patches on Google's release day. Samsung typically follows within one to two weeks. Other OEMs have historically lagged by weeks to months.

What You Should Do Right Now

• Check your patch level immediately. On any Android device, navigate to Settings → About Phone → Android Security Update. Verify the date reads 2026-05-01 or later.
• Enable automatic updates. Settings → System → System Update → enable automatic download and install.
• Disable wireless ADB when not needed. Developer Options → Wireless ADB debugging should be toggled off on any device that does not require it for active development work.
• Audit enterprise MDM (Mobile Device Management) policies. If your MDM platform (Workspace ONE, Intune, Jamf) supports security patch enforcement, configure a policy that flags or quarantines devices below the 2026-05-01 patch level.
• Segment Wi-Fi networks. Ensure employee personal devices and corporate infrastructure are on separate VLANs (Virtual Local Area Networks — isolated network segments that prevent cross-device communication) to limit blast radius if a device is compromised.
• Monitor for ADB connections. On rooted or developer-mode devices, unusual ADB sessions are a signal of exploitation; review relevant EDR (Endpoint Detection and Response) telemetry for Android.

Background: Understanding the Risk

The Android Debug Bridge (ADB) was designed as a developer diagnostic tool — it allows engineers to install apps, read logs, run shell commands, and mirror a device's screen. Wireless ADB extends this capability over a network connection, authenticated via mutual TLS. CVE-2026-0073 breaks that TLS handshake's verification logic, letting an attacker present a malformed or invalid certificate that the daemon accepts.

This class of bug — a certificate validation bypass in a debug or management interface — has a long and consistent history on Android. CVE-2021-0934 in 2021 allowed similar adjacent-network abuse of ADB. Prior to Android 10, ADB over USB was frequently exploited in physical-access scenarios before Google added pairing-code protection in Android 11.

What makes CVE-2026-0073 notable in 2026 is scale: Android 14, 15, and 16 together represent an enormous installed base — well over one billion active devices. Even if exploitation requires network proximity, the sheer number of devices and the variety of environments in which they are deployed (corporate offices, healthcare, critical infrastructure support staff) makes aggressive patching essential.

Google's Project Mainline delivery mechanism is a genuine improvement over the traditional OEM patch pipeline; critical fixes can reach devices without waiting for a full OS update. But device owners must ensure their devices are online and configured to receive these updates.

Conclusion

CVE-2026-0073 is a critical, zero-click adjacently-exploitable RCE in Android's ADB daemon that affects Android 14, 15, 16, and 16-QPR2. Google has shipped the fix in the May 2026 Android Security Bulletin. The single most important action is verifying that every managed Android device reaches the 2026-05-01 patch level. On devices where OEM delivery is slow, disabling wireless ADB is an effective interim mitigation that eliminates the attack vector entirely.