CVE-2026-0081: Critical severity Google Android vulnerability
In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add or enable a permission check for incoming NFC events so that spoofed NFC events cannot be processed without the required permission, preventing local escalation of privilege.
NFC subsystem permission_check = enabled - Compensating control
Disable NFC hardware/radio on devices where NFC is not required, or otherwise restrict NFC use to trusted users/devices, until an upstream fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0081?
CVE-2026-0081 has a critical severity rating of 10 based on the CVSS score.
How do I fix CVE-2026-0081?
To resolve CVE-2026-0081, update your Google Android device to the latest security patch that addresses this vulnerability.
What impact does CVE-2026-0081 have on devices?
CVE-2026-0081 can lead to local escalation of privilege without requiring any additional execution privileges.
Is user interaction required to exploit CVE-2026-0081?
No, user interaction is not needed for exploitation of CVE-2026-0081.
What type of attack does CVE-2026-0081 relate to?
CVE-2026-0081 relates to the spoofing of NFC events due to a missing permission check.