Android NFC CVE-2026-0083

Requires the ability to execute code on the target Android device (e.g., an installed app or already-foothold process) that can interact with the NFC subsystem and reach Nfc::eventCallback() - NFC must be enabled on the device for the event callback path to be reachable. No user interaction and no additional execution privileges are needed per the description. Exploitation is a race condition, so success is probabilistic and depends on scheduler timing and device load; reliability on specific SoC/kernel builds is unconfirmed. The CVSS vector in the input asserts network attack vector, but the description is explicit that this is local EoP - defenders should treat 'local code execution on device with NFC enabled' as the operative prerequisite until the vendor clarifies.

Significant signal conflict requires explicit attention: the supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and score of 10.0 indicate remote, unauthenticated, network-reachable exploitation with scope-changing impact across all CIA - yet the CVE description explicitly states 'local escalation of privilege' with 'no additional execution privileges needed.' This is contradictory: a local EoP should carry AV:L, not AV:N, and the 10.0 rating appears inflated relative to the stated impact. EPSS, KEV status, and POC indicators are absent from the input, so real-world exploitation likelihood cannot be quantified; absence is not evidence of safety. Tags include both Privilege Escalation and Denial of Service, consistent with a memory-corruption race. Treating this as a high-priority local EoP affecting any process able to interact with the NFC service - the description's wording - is the defensible interpretation pending vendor clarification.

A malicious or compromised app running on an unpatched Android device repeatedly triggers NFC events while concurrently freeing the underlying object referenced by Nfc::eventCallback(), winning the race and reusing the freed memory to hijack control flow within the NFC service context. Because no user interaction is required and no additional execution privileges are needed beyond the ability to interact with the NFC subsystem, the attacker elevates from an unprivileged app sandbox toward the NFC service's privileges, potentially pivoting further. No public exploit identified at time of analysis.