EUVD-2026-38553Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Local co-installed app with no permissions (AV:L, PR:N, UI:N) injects data that crosses into the Home Assistant server (S:C), affecting integrity only (I:H, C:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services LocationResult directly to it; the receiver trusts the extra and forwards it to the user's Home Assistant server as the device's real location. This bypasses Android's developer-mode "Mock Location" gate and allows a local malicious app to drive zone-based automations (unlock door / disarm alarm / open garage) by faking the user's GPS position. This vulnerability is fixed in 2026.5.3.
AnalysisAI
Location spoofing in the Home Assistant Android companion app prior to 2026.5.3 allows any co-installed application - even one with zero runtime permissions - to forge the device's reported GPS position by broadcasting a crafted Google Play Services LocationResult to an unprotected exported BroadcastReceiver. The forged coordinates are forwarded to the user's Home Assistant server as the device's real location, defeating Android's developer-mode Mock Location gate and enabling abuse of zone-based automations such as unlocking doors, disarming alarms, or opening garages. No public exploit identified at time of analysis, and the issue is patched in 2026.5.3 by unexporting LocationSensorManager and introducing a thin RequestAccurateLocationReceiver proxy that drops attacker-supplied extras.
Technical ContextAI
The affected component is LocationSensorManager, a BroadcastReceiver in the Home Assistant Android companion app (cpe:2.3:a:home-assistant:core:*) that integrates with the Fused Location Provider of Google Play Services. The Android manifest previously declared the receiver with android:exported=true and no signature- or permission-based protection, so any other app on the device could deliver intents to it via an explicit component target. CWE-926 (Improper Export of Android Application Components) captures the root cause: the receiver trusted the LocationResult extras carried in the incoming Intent and forwarded them to the Home Assistant server without verifying that they originated from Google Play Services. The patch in PR #6837 sets the underlying LocationSensorManager to exported=false and introduces a separate RequestAccurateLocationReceiver that only relays the ACTION_REQUEST_ACCURATE_LOCATION_UPDATE action via an explicit-component broadcast, deliberately discarding any caller-supplied extras.
RemediationAI
Vendor-released patch: upgrade the Home Assistant Android companion app to version 2026.5.3 or later, which unexports LocationSensorManager and introduces the RequestAccurateLocationReceiver proxy that drops attacker-supplied extras (see https://github.com/home-assistant/android/pull/6837 and advisory GHSA-77r5-pw5w-mgj3). Until the update is installed, users should audit installed Android apps and remove any untrusted or sideloaded applications on the same device, and review Home Assistant automations triggered by zone or device_tracker state - temporarily detach security-sensitive actions (door unlock, alarm disarm, garage open) from location-only triggers and require an additional factor such as a button press, BLE proximity, or a Wi-Fi network condition. Disabling the Home Assistant app's location sensor entirely is an option but breaks all presence-based features.
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via t
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via
An issue was discovered in Form Tools through 3.0.20. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with medi
Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0. Rated medium se
An issue was discovered in Form Tools through 3.0.20. Rated medium severity (CVSS 6.1), this vulnerability is remotely e
An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
An issue was discovered in Form Tools through 3.0.20. Rated medium severity (CVSS 5.4), this vulnerability is remotely e
OS command injection in Liman server management software (limanmys/core) before version 2.2.2 - 1103 lets an authenticat
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS
Authentication bypass in UltraDAG Core blockchain allows remote unauthenticated attackers to drain all pocket-derived su
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today