Which versions of Android NFC are affected by CVE-2026-0083?

Google Android's NFC subsystem contains a critical local privilege escalation vulnerability (CVSS 10.0) affecting Android 17 devices, allowing unprivileged local processes to gain elevated system…

How to fix or mitigate CVE-2026-0083?

Within 24 hours: inventory all Android 17 devices, categorize by sensitivity (especially those with access to sensitive data or enterprise networks), and document device ownership. Within 7 days: implement interim mitigations including disabling NFC on devices without NFC requirements, enabling enhanced SELinux restrictions on NFC service, restricting untrusted application installation, and establishing process-level monitoring for privilege escalation attempts. Within 30 days: deploy enterprise-wide monitoring for exploitation indicators, establish vendor communication channels for patch notification, and prepare rapid deployment procedures for when Google releases a security update.

Android NFC CVE-2026-0083

Q: What is the CVSS score of CVE-2026-0083?

CVE-2026-0083 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37571 CRITICAL

Race Condition (CWE-362)

2026-06-17 google_android

Privilege Escalation Denial Of Service Google Race Condition

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Description states local EoP from an unprivileged context with no UI; race condition raises AC to High; impact is full compromise of the NFC service context, hence C/I/A High.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:26 vuln.today

CVE Published

Jun 17, 2026 - 07:15 cve.org

CRITICAL 10.0

DescriptionCVE.org

In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android's NFC subsystem stems from a use-after-free condition in Nfc::eventCallback() within Nfc.h, triggerable via a race condition without user interaction or additional execution privileges. Affected devices covered by the Android Security Bulletin for Android 17 can have an unprivileged local process win the race and elevate to higher-privileged context. No public exploit identified at time of analysis; the vulnerability was disclosed by Google through the Android security bulletin process.

Technical ContextAI

The flaw resides in the native NFC stack, specifically the eventCallback() handler defined in Nfc.h, which dispatches NFC events to registered consumers. A race condition between event delivery and object lifecycle management allows one thread to free a heap object that another thread is still dereferencing inside the callback path, producing a classic use-after-free. CWE is not assigned by the source but this pattern maps to CWE-416 (Use After Free) compounded by CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). Per the supplied CPE (cpe:2.3:a:google:android), the affected component is Google Android; the fix is tracked under the Android 17 security bulletin at source.android.com.

RemediationAI

Apply the Android security patch level published in the Android 17 security bulletin at https://source.android.com/docs/security/bulletin/android-17 as soon as the OEM/carrier makes it available; on Pixel and other Google-managed devices this typically arrives as a monthly OTA, while third-party OEM devices depend on vendor build cadence. Patch available per vendor advisory; an exact fixed build string is not enumerated in the supplied data, so verify the device's reported Security Patch Level matches or exceeds the Android 17 bulletin date after update. As an interim compensating control, disable NFC in Settings on devices that cannot be promptly patched - this removes the attack surface entirely at the cost of losing contactless payments, tap-to-pair, and HCE functionality. For managed fleets, MDM policies can disable NFC and restrict installation of untrusted apps that could host a local exploit primitive.