Android EUVD-2026-33809

Attacker must already have code execution on the device as an installed third-party application with NFC/HCE service registration capability (PR:L - local low privilege). The vulnerable code path is reached via the HostEmulationManager onNullBinding callback, requiring the attacker app to bind to or register as an HCE service and induce a null IBinder return. The description explicitly requires user interaction (e.g., a tap, notification response, or app launch), which conflicts with the CVSS UI:N marking and should be treated as a real limiting factor. Only Android 14, 15, 16, and 16-qpr2 prior to the 2026-06-01 patch level are affected; devices with restricted sideloading, no NFC hardware, or already on the June 2026 patch level are not exposed.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high local impact but requires an attacker-controlled app already running on the device, with low privileges. Note the conflict between the CVSS vector (UI:N) and the description, which explicitly states user interaction is required - defenders should treat real-world exploitation as gated by a user tap or similar action. CISA SSVC rates Exploitation as 'none' and Automatable as 'no' with Technical Impact 'total', indicating no observed exploitation; it is not in CISA KEV and no EPSS score is provided. Overall this is a meaningful escalation primitive often chained into malware tap-jacking or overlay attacks, but it is not an immediate emergency for fleets that already restrict sideloading.

A user installs a seemingly benign app from a third-party store or a sideloaded APK; the app registers an NFC HCE service and waits in the background. When the user interacts with the app (e.g., taps a notification or button), the malicious service triggers the onNullBinding logic flaw to launch a phishing or overlay activity from the background, capturing credentials or escalating to higher-privileged components. No public POC is identified at time of analysis.