CVE-2026-0082: Critical severity Google Android vulnerability
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the insecure default in NfcDispatcher.java so that special app access is not automatically assigned. Require explicit user or system approval (or an explicit API call) before granting special permissions.
NfcDispatcher (NfcDispatcher.java) automatic_special_app_access_assignment = disabled / require explicit grant - Operational
Audit devices for apps that may have been granted special app access automatically and revoke any unauthorized assignments. Notify affected users and review installed apps/permissions for suspicious or unnecessary privileges.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0082?
CVE-2026-0082 has a critical severity rating of 10.
How do I fix CVE-2026-0082?
To remediate CVE-2026-0082, ensure your Google Android software is updated to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-0082?
CVE-2026-0082 is a local escalation of privilege vulnerability that may allow unauthorized access to special app permissions.
Who is affected by CVE-2026-0082?
Users of Google Android devices are affected by CVE-2026-0082 due to an insecure default value in the NfcDispatcher.java file.
Is user interaction required to exploit CVE-2026-0082?
No, CVE-2026-0082 can be exploited without any user interaction.