EUVD-2026-73961
GHSA-wc2c-5c2h-j55f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious APK to device
-
DeliveryApp installed with low-privilege context
-
ExploitInvoke unguarded NfcService.java methods
-
ExecutionRegister unauthorized payment session handler
-
PersistVictim taps contactless terminal
-
ImpactIntercept or redirect NFC payment transaction
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious application to be installed on the target Android 15 or Android 16 device - this is the primary limiting factor, as AV:L means no remote network path exists. The installed app needs only the low-privilege context granted to any normally-installed APK (PR:L); no elevated Android permissions, root, or system privileges are required to reach the vulnerable NfcService.java functions. NFC hardware must be present on the device (standard on most modern Android phones). No user interaction is required after app installation (UI:N), meaning the hijacking occurs silently. Exploitation is bounded to devices not yet patched to the 2026-09-01 Android security patch level. |
| Impact | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores all three impact dimensions as High, reflecting full compromise of confidentiality, integrity, and availability within the NFC subsystem - consistent with the payment-hijacking primitive described. EPSS of 0.11% (2nd percentile) and CISA SSVC Exploitation: none both indicate no observed active exploitation, and Automatable: no reflects the local-access prerequisite. The gap between CVSS Technical Impact: total (per SSVC) and low EPSS is expected here: the flaw requires a malicious app to be installed on the victim device, making mass automated exploitation implausible, while targeted financial-fraud scenarios (rogue apps, side-loaded APKs) represent a realistic elevated threat not captured by the EPSS base rate. No POC or KEV listing confirmed. KEV absence and EPSS alignment suggest this is a real-but-not-yet-weaponized vulnerability warranting prompt patching on NFC-enabled devices handling payment credentials. |
| Exploit ScenarioDerived | An attacker publishes a malicious Android application disguised as a utility tool and persuades a target to install it (e.g., via side-loading or a third-party store). Once installed, the app calls the unguarded NfcService.java functions without holding the required system permission, silently registering itself as a payment session handler. When the victim subsequently taps their device at a contactless payment terminal, the hijacked NFC session routes or intercepts the transaction. No public exploit code has been confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Silent NFC payment session hijacking in Android 15 and 16 allows a locally-installed low-privilege application to exploit missing permission checks in NfcService.java, enabling unauthorized manipulation of NFC payment sessions without any user interaction. The flaw is a missing authorization gate (CWE-862) across multiple functions in the NFC service, permitting a malicious app to hijack, enable, or redirect contactless payment flows targeting the device. No public exploit has been identified and CISA SSVC rates exploitation as none, though the financial-fraud potential elevates practical risk beyond what the EPSS score of 0.11% suggests.
RemediationAI
Apply the Android security patch level 2026-09-01 or later, as detailed in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-09-01. OEM and carrier updates incorporating this patch level should be applied as soon as available via device OTA updates. Until patching is possible, organizations managing device fleets should restrict side-loaded or unknown-source application installation, as exploitation requires a malicious app to be present on the device; disabling the 'Install unknown apps' permission via MDM policy reduces the primary delivery vector. On devices that do not require NFC functionality, disabling NFC entirely in device settings eliminates the attack surface with no security trade-off. No vendor-released workaround beyond the patch is documented.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NfcService.java is the core Android system service managing Near Field Communication hardware and protocol orchestration, including Host Card Emulation (HCE) payment sessions used in contactless payment flows (Google Pay, etc.). CWE-862 (Missing Authorization) describes the root cause: specific API methods within NfcService lack a permission check, meaning any caller with a basic installed-app context (PR:L) can invoke privileged NFC operations without holding the normally-required system or signature-level permission. Affected platforms are Android 15 and Android 16 per EUVD-2026-73961. The CVSS vector AV:L/AC:L/PR:L/UI:N reflects that exploitation is entirely local and requires no complexity beyond holding a normally-installed application identity.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack (AV:L) via installed app (PR:L); no complexity or interaction required; full NFC subsystem compromise justifies C:H/I:H/A:H within unchanged scope.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android 15 and 16 devices contain a missing authorization flaw in NFC services (CVE-2026-28611) that allows any installed application to silently hijack contactless payment transactions without user knowledge or interaction. This creates direct financial fraud risk for organizations and employees using mobile payments, with no currently available patch requiring immediate interim protective measures.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce MDM-based app installation restrictions to official stores only; deploy application monitoring to detect unauthorized NFC access patterns; advise users to disable NFC hardware if contactless payments are non-essential; implement transaction anomaly detection at payment processor level to identify payment hijacking; conduct app security scans on existing installed base to identify potentially malicious applications; provide user training on installation risks from unofficial application sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB