Android NFC CVE-2026-0081

Attacker must have code execution as an unprivileged local app on the target Android device (e.g., a sideloaded or malicious Play-distributed app); no NFC permission, no root, and no user interaction are required, and the NFC subsystem must be present and enabled in the device build. Exploitation is constrained to on-device local privilege escalation against Android builds predating the Android 17 bulletin patch level - it is not reachable from the network, not reachable from another device over NFC radio, and does not apply to devices already at the patched SPL.

Signals are mixed and should be interpreted with care. The reported CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H and SC/SI/SA:H, score 10.0) is inconsistent with the description, which explicitly states 'local escalation of privilege' - AV should almost certainly be L (local app on device), not N, so the headline 10.0 overstates real-world reach. EPSS, KEV, and POC data are not provided in the input: there is no indication of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis. Realistic risk is moderate-to-high on unpatched Android devices because exploitation requires only a locally installed app with no user interaction, which fits malware and supply-chain-app threat models, but it is not remotely reachable from the network. Treat as a standard monthly Android Security Bulletin priority rather than an emergency remote RCE.

A user installs a seemingly benign app from a sideload or low-reputation store; the app, holding no NFC-related permissions, invokes the unchecked code path to dispatch or receive spoofed NFC events to a privileged system handler. The handler acts on the forged event - for example, triggering a payment-related intent or a tag-dispatch flow tied to elevated capabilities - giving the app effective access it should not have. No user interaction with NFC hardware is required.