CVE-2026-0083: Android NFC Use-After-Free Race Condition Enables Local Privilege Escalation

Technical summary

CVE-2026-0083 is a use-after-free vulnerability in the Nfc::eventCallback() function within Nfc.h. A race condition between asynchronous NFC event processing and memory management allows an attacker to reference freed memory, leading to arbitrary code execution at a higher privilege level. The CVSS 3.1 score of 7.0 (HIGH) reflects the local attack vector (AV:L), high complexity (AC:H) due to race condition timing constraints, and broad impact across confidentiality, integrity, and availability (C:H/I:H/A:H) despite requiring low privileges (PR:L).

Business impact

This vulnerability poses a material risk to organizations deploying Android devices in regulated or sensitive environments. Compromised devices could leak intellectual property, authentication credentials, or personal data. The lack of user interaction requirement means attacks could occur silently during normal device operation. Organizations managing Android fleets should consider this a priority for devices handling confidential information or operating in high-value networks.

Affected systems

Google Android is affected. Specific version ranges, device models, and whether the issue affects custom Android derivatives or only official AOSP builds have not been detailed in available advisories—consult Google's security bulletins and your device manufacturer's guidance to determine your exact exposure.

Exploitability

While a race condition inherently requires precise timing to succeed, this vulnerability does not appear in the CISA KEV catalog, suggesting either limited real-world exploitation evidence or ongoing investigation. The requirement for local access and race condition complexity raises the bar for opportunistic exploitation, but determined attackers can reliably trigger the condition through repeated attempts or specialized tooling.

Remediation

Patching is the primary mitigation. Apply security updates from Google or your device manufacturer as soon as they become available. If patching cannot occur immediately, limit local access to devices by disabling NFC where not operationally necessary, enforcing strong authentication controls, and monitoring privileged process behavior for anomalies.

Patch guidance

Check Google's Android Security & Privacy Year in Review or your device manufacturer's security bulletin for patches addressing CVE-2026-0083. Verify the patch was included in the specified security patch level before deploying. For enterprise Android deployments, coordinate patching through your MDM/EMM solution. OEM update timelines vary; devices from major manufacturers typically receive priority, while older or budget-tier devices may lag significantly.

Detection guidance

Monitor for suspicious use-after-free crashes in NFC-related system components and privilege escalation attempts originating from applications with low-level permissions. Look for unexpected elevation of UID/GID in audit logs during NFC event processing, or segmentation faults in the NFC daemon followed by successful privilege assumption. Runtime integrity monitoring and strict SELinux policy enforcement strengthen detection.

Why prioritize this

HIGH severity driven by confidentiality, integrity, and availability impact combined with low privilege requirements and no user interaction. Although race condition complexity and local-only access reduce real-world exploitation probability compared to network-based vulnerabilities, the silent nature of attacks and broad data theft or system modification risk warrant rapid patching of devices in sensitive roles.

Risk score, explained

The CVSS 3.1 score of 7.0 reflects a well-scoped but impactful local privilege escalation. Attack complexity is rated HIGH because race conditions demand precise timing and often multiple attempts. However, the low privilege prerequisite (low-level app permissions can suffice) and complete confidentiality, integrity, and availability compromise push severity into the HIGH band despite local-only delivery. Organizations should not discount this as low-priority based on access requirements alone.

Frequently asked questions