CVE-2026-107153: Medium severity Rakuten Mobile Android Verified Boot vulnerability
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs physical access to an affected device and a crafted system image. The supplied severity vector also indicates low privileges are required.
What could an attacker do after exploiting the issue?
They may install a crafted system image on the device. The reported impact ratings indicate potential high impact to confidentiality, integrity, and availability.
Which devices are identified in the available information?
The information states that multiple smartphones provided by Rakuten Mobile are affected. The references include support pages for Rakuten Mini, Rakuten Hand, and Rakuten Hand 5G, but the supplied data does not provide a definitive affected-model list or firmware versions.