EUVD-2026-73961
GHSA-wc2c-5c2h-j55f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack (AV:L) via installed app (PR:L); no complexity or interaction required; full NFC subsystem compromise justifies C:H/I:H/A:H within unchanged scope.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
6DescriptionCVE.org
In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Silent NFC payment session hijacking in Android 15 and 16 allows a locally-installed low-privilege application to exploit missing permission checks in NfcService.java, enabling unauthorized manipulation of NFC payment sessions without any user interaction. The flaw is a missing authorization gate (CWE-862) across multiple functions in the NFC service, permitting a malicious app to hijack, enable, or redirect contactless payment flows targeting the device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a malicious application to be installed on the target Android 15 or Android 16 device - this is the primary limiting factor, as AV:L means no remote network path exists. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores all three impact dimensions as High, reflecting full compromise of confidentiality, integrity, and availability within the NFC subsystem - consistent with the payment-hijacking primitive described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Android security patch level 2026-09-01 or later, as detailed in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-09-01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Android 15 and 16 devices in your environment with active NFC payment capabilities and assess organizational financial exposure from potential payment redirection. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today