Skip to main content

Android NFC CVE-2026-0083

| EUVDEUVD-2026-37571 CRITICAL
Race Condition (CWE-362)
2026-06-17 google_android
Privilege Escalation Denial Of Service Race Condition
10.0
CVSS 4.0 · Vendor: google_android
Share

Severity by source

Vendor (google_android) PRIMARY
10.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.0 HIGH

Description states local EoP from an unprivileged context with no UI; race condition raises AC to High; impact is full compromise of the NFC service context, hence C/I/A High.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jun 17, 2026 - 08:26 vuln.today
CVE Published
Jun 17, 2026 - 07:15 cve.org
CRITICAL 10.0

DescriptionCVE.org

In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android's NFC subsystem stems from a use-after-free condition in Nfc::eventCallback() within Nfc.h, triggerable via a race condition without user interaction or additional execution privileges. Affected devices covered by the Android Security Bulletin for Android 17 can have an unprivileged local process win the race and elevate to higher-privileged context. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Install or compromise unprivileged Android app
Delivery
Enumerate NFC service reachability
Exploit
Spawn racing threads against Nfc::eventCallback()
Execution
Trigger use-after-free on freed object
Persist
Hijack control flow in NFC context
Impact
Escalate privileges on device
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the ability to execute code on the target Android device (e.g., an installed app or already-foothold process) that can interact with the NFC subsystem and reach Nfc::eventCallback() - NFC must be enabled on the device for the event callback path to be reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Significant signal conflict requires explicit attention: the supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and score of 10.0 indicate remote, unauthenticated, network-reachable exploitation with scope-changing impact across all CIA - yet the CVE description explicitly states 'local escalation of privilege' with 'no additional execution privileges needed.' This is contradictory: a local EoP should carry AV:L, not AV:N, and the 10.0 rating appears inflated relative to the stated impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A malicious or compromised app running on an unpatched Android device repeatedly triggers NFC events while concurrently freeing the underlying object referenced by Nfc::eventCallback(), winning the race and reusing the freed memory to hijack control flow within the NFC service context. Because no user interaction is required and no additional execution privileges are needed beyond the ability to interact with the NFC subsystem, the attacker elevates from an unprivileged app sandbox toward the NFC service's privileges, potentially pivoting further. …
Remediation Apply the Android security patch level published in the Android 17 security bulletin at https://source.android.com/docs/security/bulletin/android-17 as soon as the OEM/carrier makes it available; on Pixel and other Google-managed devices this typically arrives as a monthly OTA, while third-party OEM devices depend on vendor build cadence. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Android 17 devices, categorize by sensitivity (especially those with access to sensitive data or enterprise networks), and document device ownership. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-362 – Race Condition

View all
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3
CVE-2015-8556 CRITICAL POC
10.0

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2026-0083 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy