CVE-2026-0081: Android NFC Privilege Escalation – Missing Permission Check

Technical summary

The vulnerability stems from an authorization bypass in the NFC stack where event validation does not enforce required permission checks. CWE-862 (Missing Authorization) describes the root cause: a code path that triggers NFC event processing lacks verification that the calling process holds the necessary privileges. An attacker running with standard user-level permissions can invoke this path and spoof legitimate NFC notifications, causing the system to treat malicious input as trusted NFC activity. The attack surface is local-only (AV:L), requires no additional tricks (AC:L), and operates within the security context of a single user (S:U), but fully compromises confidentiality, integrity, and availability of the affected privilege level (C:H/I:H/A:H).

Business impact

Privilege escalation vulnerabilities in core OS subsystems pose moderate to high business risk depending on device deployment. For enterprise environments with COPE (Corporate-Owned Personally-Enabled) or fully managed Android deployments, this flaw could allow a compromised or malicious app to bypass Android's permission model, accessing sensitive data or modifying system settings. Financial services, healthcare, and government organizations managing Android fleets should prioritize mitigation. Consumer risk is lower but still relevant for users who sideload apps or have exploited devices.

Affected systems

Google Android is the sole affected vendor-product listed. The vulnerability affects the NFC subsystem, so impact is limited to Android devices with NFC hardware. Phones and tablets without NFC capability are unaffected. The flaw is not tied to a specific Android version in the source data; confirm the scope (Android 12+, 13+, etc.) against Google's security advisory.

Exploitability

Exploitability is straightforward. The attack requires local code execution at standard user privilege level—no elevated permissions needed at the outset. NFC event spoofing can be triggered programmatically without user interaction (UI:N), making automation and silent exploitation feasible. An attacker must first achieve local code execution (e.g., via a compromised app), but once resident, escalation is reliable and self-contained. The flaw is not currently listed on CISA's KEV catalog, suggesting either limited in-the-wild exploitation at publication time or a recent disclosure.

Remediation

Google's security team will release patches through the monthly Android security bulletin process. Remediation requires restoring the missing permission check in the NFC event handler, ensuring that only authorized callers can trigger NFC event processing. Device owners should prioritize patching NFC-capable Android devices as updates become available, and enterprise deployments should enforce mobile device management (MDM) policies to mandate timely security updates. Interim mitigations include disabling NFC if unused and restricting app installation to trusted sources.

Patch guidance

Monitor Google's Android Security & Privacy Year in Review and the monthly Security & Maintenance Release bulletins for patch availability and affected version details. Apply patches immediately upon release to all managed Android devices. For enterprise deployments, use MDM solutions to automate patch distribution and verify compliance. Test patches in a staging environment first to confirm compatibility with business-critical apps. Verify patch installation by checking the security patch level in Settings > About Phone.

Detection guidance

Detection is challenging without app-level logging or kernel-level auditing. Organizations should: (1) monitor for unexpected privilege escalation events in device logs, particularly correlating app lifecycle with system permission changes; (2) use MDM-based threat detection to flag devices running older security patch levels or exhibiting anomalous NFC behavior; (3) enable SELinux audit logging if available to capture unauthorized NFC subsystem access attempts. Behavioral indicators include apps requesting NFC permissions without legitimate reason or performing NFC-like operations while NFC hardware is disabled.

Why prioritize this

HIGH CVSS (7.8) driven by unrestricted local privilege escalation with full impact on confidentiality, integrity, and availability. The missing authorization check is a fundamental design flaw, not a complex exploitation chain. Lack of user interaction (UI:N) and low complexity (AC:L) mean any resident malware or sideloaded app can abuse it. Although not yet in CISA KEV, the flaw's simplicity and Android's massive installed base warrant prompt patching in enterprise and security-sensitive deployments.

Risk score, explained

CVSS 7.8 (HIGH) reflects the combination of local-only attack vector, low complexity, and full compromise of the affected user context. The score does not account for device-specific factors (presence of NFC hardware) or organizational risk (single-user vs. multi-tenant deployment), which may shift practical risk up or down. In environments where unprivileged apps routinely request NFC access, effective exploitation risk is higher; in NFC-disabled deployments, it is lower.

Frequently asked questions