Google Patches Android Wireless ADB Auth Bypass Enabling Zero-Click Shell Access

Google fixed CVE-2026-0073, a critical flaw in Android’s adbd component that allowed a nearby attacker to bypass wireless ADB authentication and execute code as the shell user with no user interaction. The bug affected Android 14, 15, 16, and 16-QPR2, and was traced to a logic error in adbd_tls_verify_cert that mishandled certificate key comparisons, letting a malicious client certificate impersonate a trusted ADB host. Researchers said exploitation could expose data, install apps, alter settings, and provide a path toward broader device compromise.

The vulnerability primarily exposed devices with Developer Options and wireless debugging enabled, where the attacker could reach ADB on TCP port 5555 and the device had at least one previously paired RSA host key. Google included the fix in the 2026-05-01 Android security patch level and also distributed remediation through the Project Mainline adbd module for supported devices, while stating it had no evidence of public exploitation or in-the-wild attacks. The issue was credited to Ovi (@0x0v1) of Barghest, and defenders were urged to apply updates, disable wireless ADB where unnecessary, revoke unknown debugging authorizations, and restrict network exposure to ADB services.