What is the CVSS score of CVE-2026-0082?

CVE-2026-0082 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-0082?

24 hours: Inventory all production Android-17 devices; identify systems with NFC capability and active app ecosystems. 7 days: Deploy app permission policies that restrict NFC subsystem access to explicitly whitelisted applications; disable NFC on devices where functionality is not operationally required. 30 days: Monitor Android Security Bulletins for patch availability; establish pre-staging procedures for Android-17 security updates when released by device manufacturers.

Android CVE-2026-0082

EUVD-2026-37570 CRITICAL

Insecure Default Variable Initialization (CWE-453)

2026-06-17 google_android

Privilege Escalation Google

10.0

CVSS 4.0 · Vendor: google_android

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Install malicious app on device
Delivery

Invoke NFC dispatch path
Exploit

Trigger insecure default in tryStartActivity
Execution

Auto-assigned special app access granted
Impact

Abuse elevated permission to read user data

Vulnerability Assessment

Weakness	CWE CWE-453
Exploitation Conditions	Requires a local app installed on the affected Android build that can trigger NfcDispatcher.tryStartActivity - i.e., code execution on the device at normal app sandbox level is the only prerequisite per the description ('no additional execution privileges needed', 'User interaction is not needed'). The NFC stack must be reachable (NFC enabled or the dispatcher reachable via intent), and the device must be running an Android version at a pre-fix security patch level. CVSS lists AV:N but the description explicitly says local escalation of privilege, so realistic exploitation is local-only and limited to attackers who already have an app running on the target.
Impact	Signals here conflict and need explicit calling out. CVSS 4.0 is scored 10.0 with AV:N/AC:L/PR:N/UI:N and Subsequent-System impacts all High, yet the description plainly says 'local escalation of privilege' and the underlying code is an on-device NFC dispatcher - AV:N is almost certainly wrong; AV:L (or AV:P for true NFC proximity) is the realistic vector. With that correction the practical risk is high but not 'internet-wormable': a malicious local app already on the device can silently obtain special app access. No KEV listing, no published POC, and no EPSS provided, so this is no public exploit identified at time of analysis. Net: treat as a high-severity local EoP that materially weakens Android's permission model on unpatched builds, but do not prioritize it above truly remote 10.0s.
Exploit ScenarioDerived	A user installs a low-privilege app from a third-party store or sideload. The app silently invokes the NFC dispatch path so that tryStartActivity executes with the insecure default, causing the OS to auto-grant the app a special app access permission (e.g., Usage Access or Notification Listener). The app then reads other apps' notifications or usage history without ever showing the user a permission prompt; no POC is currently public.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 17, 2026

Local privilege escalation in Google Android's NFC subsystem allows unprivileged local apps to gain special app access permissions without user interaction, due to an insecure default value in NfcDispatcher.tryStartActivity. Affected Android builds are covered by the Android Security Bulletin (android-17 reference). No public exploit identified at time of analysis; tagged as Privilege Escalation by the Android reporter.

RemediationAI

Patch available per vendor advisory - install the Android security patch level referenced in https://source.android.com/docs/security/bulletin/android-17 (exact fix version not enumerated in the provided input; consult the bulletin for the SPL string and per-branch AOSP tags). On devices where the SPL is not yet shipped by the OEM, compensating controls are limited because the vulnerable code is in the platform NFC dispatcher: disable NFC in Settings → Connected devices → NFC (side effect: loses tap-to-pay, Android Beam-style sharing, and NFC tag reading), and restrict sideloading by disabling 'Install unknown apps' for all sources so a malicious local app cannot reach the dispatcher in the first place. Enterprise fleets should enforce these via MDM policy until the monthly patch is deployed.

Affected VersionsENISA

Android 17

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw resides in NfcDispatcher.java, the framework component that resolves NFC tag/intent dispatch to a target activity. tryStartActivity is the dispatch path that launches an activity for a discovered NFC event; an insecure default in this code path causes 'special app access' (the high-privilege AppOps-style permissions such as Usage Access, Notification Listener, Device Admin, or similar restricted operations) to be auto-assigned to a calling/target component. CPE coverage is cpe:2.3:a:google:android - i.e., Android platform code (AOSP framework), not a single OEM app. The root cause class maps to CWE-276 (Incorrect Default Permissions) / CWE-732 (Incorrect Permission Assignment), though no CWE was provided in the input.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (google_android) PRIMARY 10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI 7.8 HIGH

Requires a local app on the device (AV:L, PR:L for sandboxed app), no user interaction, insecure default reliably triggers (AC:L), special app access enables broad data and integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

DescriptionCVE.org

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Executive ViewAI

Why It Matters

A critical flaw in Android-17's NFC subsystem allows any installed application to escalate privileges and acquire special permissions without user awareness, creating a pathway for malware to bypass access controls and compromise sensitive device functions. Organizations with Android devices must immediately implement permission restrictions and prepare contingency controls, as no vendor patch is currently available.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict third-party application access to NFC-related permissions via MDM policy; (2) implement application allowlisting to limit which apps execute with elevated capabilities; (3) disable NFC radio on non-essential devices; (4) deploy app permission change monitoring to detect unauthorized permission acquisition; (5) maintain strict app vetting processes for app store deployments to Android-17 devices.

Threat Intelligence Overview

EPSS Score

0.2%

Top 85% exploitable

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +50

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.