CVE-2026-0083: Race Condition
In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the NFC subsystem/service or disable NFC in firmware/OS until a vendor fix is applied to prevent triggering the use-after-free in Nfc::eventCallback.
NFC (Nfc::eventCallback in Nfc.h) enabled = false - Compensating control
Restrict local access to the device's NFC interfaces and device nodes (for example via filesystem permissions, udev rules, or SELinux/AppArmor profiles) and limit unprivileged local accounts to reduce the ability of local actors to trigger the vulnerable callback.
- Operational
Monitor vendor and security advisories for a patch addressing the Nfc::eventCallback use-after-free. When a vendor fix is released, apply it immediately to affected systems and reboot as required.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0083?
The severity of CVE-2026-0083 is critical with a CVSS score of 10.
What kind of vulnerability is CVE-2026-0083?
CVE-2026-0083 describes a use after free vulnerability due to a race condition in the Nfc::eventCallback() function.
How can CVE-2026-0083 be exploited?
CVE-2026-0083 can be exploited locally to escalate privileges without requiring additional execution privileges or user interaction.
What software is affected by CVE-2026-0083?
CVE-2026-0083 affects Google Android.
How do I fix CVE-2026-0083?
To fix CVE-2026-0083, users should update their Google Android devices to the latest security patch provided by Google.