CVE-2026-0073: High severity Google Android Debug Bridge (adbd) vulnerability

Published May 4, 2026

Updated

In adbdtlsverifycert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

7 affected components

Google Android Debug Bridge (adbd)

Google Android=14.0

Google Android=15.0

Google Android=16.0

Google Android=16.0-qpr2_beta_1

Google Android=16.0-qpr2_beta_2

Google Android=16.0-qpr2_beta_3

Event History

May 4, 2026

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0073?

CVE-2026-0073 has a high severity level due to its potential for remote code execution.

How do I fix CVE-2026-0073?

To mitigate CVE-2026-0073, ensure you are using the latest version of the Android Debug Bridge that patches this vulnerability.

What impact does CVE-2026-0073 have on my systems?

CVE-2026-0073 can lead to unauthorized remote code execution on vulnerable devices, potentially compromising their security.

Is user interaction required to exploit CVE-2026-0073?

No, user interaction is not needed to exploit CVE-2026-0073, making it particularly concerning.

Which software is affected by CVE-2026-0073?

CVE-2026-0073 specifically affects the Google Android Debug Bridge (adbd).