Which versions of Android Wear OS are affected by EUVD-2026-37857?

A critical flaw in Google Wear OS allows any installed third-party application to render wearable devices inoperative through denial of service, without user interaction or elevated permissions.

How to fix or mitigate EUVD-2026-37857?

Within 24 hours: Inventory all Wear OS devices and third-party applications; identify non-approved sources. Within 7 days: Activate MDM application allowlisting on managed Wear OS devices; block third-party app stores. Within 30 days: Monitor Google security advisories for patch release; prepare to deploy the first available patched Wear OS version.

Android Wear OS EUVD-2026-37857

Q: What is the CVSS score of EUVD-2026-37857?

EUVD-2026-37857 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-28573 CRITICAL

Missing Authorization (CWE-862)

2026-06-18 google_android

GHSA-vj42-43ch-3xp2

Authentication Bypass Denial Of Service Google

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.2 MEDIUM

Local co-resident unprivileged app triggers persistent DoS with no user interaction; no confidentiality or integrity impact per description, so AV:L, PR:N, A:H only.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 08:02 vuln.today

CVE Published

Jun 18, 2026 - 06:29 cve.org

CRITICAL 10.0

DescriptionCVE.org

In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Persistent local denial of service in Google Android (Wear OS) is possible due to a missing permission check declared in AndroidManifest.xml, allowing a co-resident unprivileged app to invoke a protected component and render device functionality unavailable. No user interaction or elevated privileges are required, but exploitation is local rather than remote despite the headline CVSS 4.0 score of 10.0. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the AndroidManifest.xml of an Android Wear OS system component, where an exported Activity, Service, Receiver, or Provider is missing an android:permission attribute (or equivalent permission gating in code). On Android, AndroidManifest.xml is the contract that the system uses to enforce inter-process access control between apps via the Binder IPC layer; when a component is exported without a signature/system-level permission, any locally installed app can bind to or invoke it. This pattern aligns with CWE-862 (Missing Authorization) / CWE-276 (Incorrect Default Permissions). The CPE cpe:2.3:a:google:android:*:* indicates Google's Android codebase, and the referenced advisory path (.../bulletin/wear/2026/2026-06-01) scopes it specifically to the Wear OS June 2026 patch level.

RemediationAI

Patch available per vendor advisory: update affected Wear OS devices to security patch level 2026-06-01 or later as published in the Android Wear bulletin at https://source.android.com/docs/security/bulletin/wear/2026/2026-06-01, and apply the corresponding OEM firmware once released. As an interim compensating control for managed fleets, restrict sideloading on Wear devices via MDM (disable installation from unknown sources and ADB), and avoid installing untrusted companion or watch apps until devices are updated - the side effect is reduced flexibility for developer/test devices. There is no practical user-facing workaround for the underlying manifest flaw itself; only the OS update closes it.