Which versions of Android are affected by CVE-2026-0082?

A critical flaw in Android-17's NFC subsystem allows any installed application to escalate privileges and acquire special permissions without user awareness, creating a pathway for malware to bypass…

How to fix or mitigate CVE-2026-0082?

24 hours: Inventory all production Android-17 devices; identify systems with NFC capability and active app ecosystems. 7 days: Deploy app permission policies that restrict NFC subsystem access to explicitly whitelisted applications; disable NFC on devices where functionality is not operationally required. 30 days: Monitor Android Security Bulletins for patch availability; establish pre-staging procedures for Android-17 security updates when released by device manufacturers.

Android CVE-2026-0082

Q: What is the CVSS score of CVE-2026-0082?

CVE-2026-0082 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37570 CRITICAL

Insecure Default Variable Initialization (CWE-453)

2026-06-17 google_android

Privilege Escalation Google

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Requires a local app on the device (AV:L, PR:L for sandboxed app), no user interaction, insecure default reliably triggers (AC:L), special app access enables broad data and integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:26 vuln.today

CVE Published

Jun 17, 2026 - 07:13 cve.org

CRITICAL 10.0

DescriptionCVE.org

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android's NFC subsystem allows unprivileged local apps to gain special app access permissions without user interaction, due to an insecure default value in NfcDispatcher.tryStartActivity. Affected Android builds are covered by the Android Security Bulletin (android-17 reference). No public exploit identified at time of analysis; tagged as Privilege Escalation by the Android reporter.

Technical ContextAI

The flaw resides in NfcDispatcher.java, the framework component that resolves NFC tag/intent dispatch to a target activity. tryStartActivity is the dispatch path that launches an activity for a discovered NFC event; an insecure default in this code path causes 'special app access' (the high-privilege AppOps-style permissions such as Usage Access, Notification Listener, Device Admin, or similar restricted operations) to be auto-assigned to a calling/target component. CPE coverage is cpe:2.3:a:google:android - i.e., Android platform code (AOSP framework), not a single OEM app. The root cause class maps to CWE-276 (Incorrect Default Permissions) / CWE-732 (Incorrect Permission Assignment), though no CWE was provided in the input.

RemediationAI

Patch available per vendor advisory - install the Android security patch level referenced in https://source.android.com/docs/security/bulletin/android-17 (exact fix version not enumerated in the provided input; consult the bulletin for the SPL string and per-branch AOSP tags). On devices where the SPL is not yet shipped by the OEM, compensating controls are limited because the vulnerable code is in the platform NFC dispatcher: disable NFC in Settings → Connected devices → NFC (side effect: loses tap-to-pay, Android Beam-style sharing, and NFC tag reading), and restrict sideloading by disabling 'Install unknown apps' for all sources so a malicious local app cannot reach the dispatcher in the first place. Enterprise fleets should enforce these via MDM policy until the monthly patch is deployed.