CVE-2026-0073: Critical Zero-Click RCE in Android ADB — Patch Android 14/15/16 Now

Google’s May 2026 Android Security Bulletin patched CVE-2026-0073, a critical zero-click remote code execution vulnerability in the Android System component. Any device running Android 14, 15, or 16 without the May 1, 2026 security patch applied is exposed. No tap required. No download needed. An attacker on the same local network can compromise the device without any victim interaction.

What’s vulnerable

The root cause is a logic error in adbd_tls_verify_cert(), the function inside auth.cpp that handles mutual TLS authentication for wireless ADB connections. The Android Debug Bridge daemon — adbd — processes authentication requests for wireless debugging over TCP. The flaw allows an attacker to bypass certificate verification entirely, at which point arbitrary code executes with the permissions of the ADB daemon. On most production devices, adbd runs as root or a root-equivalent system UID.

Attack vector

CVSS classification: Critical. The attack requires no privileges on the attacker’s side and no user interaction on the victim’s side — the two properties that make a vulnerability especially dangerous to patch at scale.

The attacker must be on the same Layer 2 network or in wireless proximity: shared corporate Wi-Fi, hotel networks, airport lounges, conference venues, or any environment where someone shares your local network. One crafted TLS handshake and the shell is open. Proof-of-concept code was circulating in private security research channels before the public bulletin.

Affected versions: Android 14, 15, and 16 (including Android 16-QPR2 and interim releases). Android 13 and earlier are not listed as affected.

The patch

Google released emergency patches on May 5, 2026, four days after the security bulletin. AOSP source code fixes followed within 48 hours of the bulletin, allowing OEM partners to accelerate their own update pipelines.

What to do right now

Check your Android security patch level: Settings → About phone → Android version → Android security update. It must read May 1, 2026 or later. If it doesn’t, update immediately.

• Pixel devices: Patch shipped via the standard May over-the-air update. Already on your device if auto-update is on.
• Samsung Galaxy (One UI 8): May security updates with the patch are rolling out this week.
• OnePlus, Motorola, Xiaomi: Typically follow 2–4 weeks after the Google bulletin. Watch for an update notification.

For enterprise and security teams

Push a policy via your MDM requiring the May 2026 security patch level on all corporate Android devices before June 1. Audit any field devices operating on shared Wi-Fi infrastructure — those are the highest-risk targets. If wireless ADB is enabled on development or staging devices, make those update jobs urgent.

Consider disabling wireless ADB via MDM profile even on patched devices. This is the third critical production vulnerability from wireless ADB in four years. The feature’s threat model was designed for developer convenience, not enterprise fleet management at scale. Patch first, then evaluate whether wireless ADB needs to be in your environment at all.