CVE-2026-55261: High severity Google Android vulnerability

Q: What level of access does an attacker need to exploit this issue?

The issue is described as enabling local escalation of privilege with no additional execution privileges needed. Exploitation does not require user interaction.

Q: Which component should be prioritized for investigation and remediation?

The affected software is Android's NFC module, specifically android/platform/packages/modules/nfc. The vulnerable function is nfa_t4tnfcee_store_rx_buf in nfa_nfcee_act.cc.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation could allow code execution and local escalation of privilege.

Published Nov 1, 2026

Updated

In nfat4tnfceestorerxbuf of nfanfceeact.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

5 affected componentsFixes available

android/platform/packages/modules/nfc>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/packages/modules/nfc>=16:0<16:2026-11-01

16:2026-11-01

android/platform/packages/modules/nfc>=16-qpr2:0<16-qpr2:2026-11-01

16-qpr2:2026-11-01

android/platform/packages/modules/nfc>=17:0<17:2026-11-01

17:2026-11-01

Google Android

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Nov 2, 2026

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

CVE Published

via MITRE·07:53 PM

Data Sourced

via MITRE·07:53 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue is described as enabling local escalation of privilege with no additional execution privileges needed. Exploitation does not require user interaction.

Which component should be prioritized for investigation and remediation?

The affected software is Android's NFC module, specifically android/platform/packages/modules/nfc. The vulnerable function is nfa_t4tnfcee_store_rx_buf in nfa_nfcee_act.cc.

What is the potential impact if exploitation succeeds?

Successful exploitation could allow code execution and local escalation of privilege.

CVE-2026-55261: High severity Google Android vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which component should be prioritized for investigation and remediation?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which component should be prioritized for investigation and remediation?

What is the potential impact if exploitation succeeds?