CVE-2026-54318: Home Assistant Android Companion Location Spoofing – HIGH Severity

Technical summary

The LocationSensorManager BroadcastReceiver in Home Assistant's Android companion app is exported without permission restrictions (CWE-926: Improper Restriction of Rendered UI Layers or Frames). A local attacker can broadcast a forged Google Play Services LocationResult directly to this receiver, which trusts the incoming extra without validation. The receiver then forwards the malicious location data to the Home Assistant server, where it is processed as authentic device telemetry. This circumvents Android's "Mock Location" detection mechanism, which normally prevents misbehaving apps from spoofing positions in the system location stack.

Business impact

Home automations triggered by geofencing—door locks, alarm systems, garage openers, scene switches—become an attack surface for local exploitation. An attacker with physical or remote access to install a single app (e.g., trojanized application or compromised plugin) can remotely manipulate a user's home security posture without triggering user-facing location permissions dialogs. This is particularly concerning for homes where location-based logic controls critical security devices. The vulnerability requires no special privileges, making it accessible to a wide range of bundled or sideloaded malware.

Affected systems

Home Assistant Companion app for Android, versions prior to 2026.5.3. Any Android device running a vulnerable version and connected to a Home Assistant instance with location-based automations is at risk. Home Assistant server itself is not directly affected; the flaw is in the Android companion app's handling of location broadcasts.

Exploitability

Exploitability is straightforward: the attacker needs only to install a local app on the target device. No runtime permissions, no special Android OS capabilities, and no user interaction are required. The malicious app sends a forged broadcast to the LocationSensorManager, which accepts and trusts it immediately. No user-facing prompt or consent mechanism stands in the way. This is a low-friction attack that scales easily across devices in an environment where Home Assistant is actively used.

Remediation

Update Home Assistant Companion to version 2026.5.3 or later. This release restricts the LocationSensorManager BroadcastReceiver to prevent unauthorized broadcasts. Additionally, review and audit location-based automations in Home Assistant to confirm they align with your security model and threat tolerance. Consider whether location-triggered actions (door unlock, alarm disarm) are essential, or whether multi-factor confirmation would be prudent in your setup.

Patch guidance

Home Assistant Companion app updates are typically distributed through the Google Play Store and automatic update channels. Users should verify they are running 2026.5.3 or a later build. Organizations managing Android devices via MDM should push this update to enrolled devices as soon as possible. Verify the update by checking the app's Settings > About or by inspecting the version field in the companion app settings within Home Assistant. No rollback is recommended once the patch is applied.

Detection guidance

Monitor for unexpected location changes in Home Assistant's entity history, especially if they do not correlate with the user's actual movement patterns or travel times. Check device logs (logcat on Android devices) for unexpected broadcasts sent to the LocationSensorManager component. On the Home Assistant server, enable debug logging for location sensor integrations and review recent location events for anomalies. If available, use Android Mobile Threat Defense (MTD) solutions or security monitoring agents to detect installation of suspicious local apps that generate broadcast intents matching LocationResult schemas.

Why prioritize this

This vulnerability combines local attack surface with high integrity impact on physical security devices. While it requires local app installation, the bar for that installation is low (sideloading, supply-chain compromise, or user error), and the consequences—unauthorized door unlock, alarm disarm, garage opening—are severe. The CVSS 7.1 score reflects high integrity impact with scope change; prioritization should account for the presence and criticality of location-based automations in your deployments.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) is driven by: local attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), scope change (S:C) because the broadcast receiver acts as a bridge to the Home Assistant server context, high integrity impact (I:H) because forged location triggers security actions, but no confidentiality (C:N) or availability (A:N) impact. The score appropriately reflects a local privilege boundary bypass with real-world consequences for home security.

Frequently asked questions