Android NfcService EUVD-2026-115419

Exploitation requires local presence on the device - specifically a malicious or compromised application able to call the affected NfcService.java functions that are missing their permission check. Per the CVSS vector (PR:N) the calling app needs no special privileges and (UI:N) no user interaction, so any installed app can trigger it. The limiting factors are the local attack vector (AV:L): the attacker must already be able to run code on the device, so there is no remote/network reach, and exploitation is bounded to the affected Android branches (14, 15, 16, 16-qpr2, 17). The precise set of affected NfcService methods and the configuration or NFC state required to reach them are not described in the available sources.

Signals are consistent and point to a genuine but non-emergency local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) indicates a locally-triggerable flaw requiring no privileges and no user interaction, yielding high confidentiality, integrity and availability impact - classic Android app-to-system escalation via a missing permission check (CWE-862). Against this, EPSS is very low (0.12%, 2nd percentile) and there is no CISA KEV listing and no public exploit reference, so there is no public exploit identified at time of analysis and no evidence of widespread or active exploitation. The vuln.today decision label is 'this_week', reflecting a high-severity, high-prevalence platform bug that should be patched on the normal monthly cadence rather than as an emergency. Note the apparent tension to resolve for responders: AV:L means exploitation is local (a malicious or compromised app already on the device), so despite the high score this is not remotely reachable - the low EPSS is consistent with that gating. No data is strongly conflicting; the main gap is that the exact code-level trigger and the specific fixed build are not detailed in the supplied references (only the Android bulletin landing page).

A malicious or low-privilege app installed on the device invokes functions in NfcService that fail to enforce the required permission check, letting the app perform NFC-privileged operations it should not be able to and thereby escalate its privileges on the system. No user interaction is required. No public exploit code is identified at time of analysis.