CVE-2026-0081: In NFC, there is a possible way to spoof an NFC event due to a missing permission check

Synopsis

This is a privilege escalation vulnerability in the NFC subsystem of Android 17, caused by a missing permission check that allows an attacker to spoof NFC events. The CVSS vector scores it at 10.0 (Critical) and indicates it is reachable over the network with no authentication required and no user interaction needed. Successful exploitation gives an attacker full control over the affected device, including reading data, modifying data, and disrupting availability of the system and connected services. No fix versions have been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network; an attacker must be able to send requests to the affected service across the network without requiring physical or local access.

• AuthenticationNot required

  No credentials or account privileges are needed to trigger the missing permission check and spoof an NFC event.

• Victim interactionNot required

  Exploitation requires no action from any user on the target device.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• A successful attacker gains local escalation of privilege, effectively operating with the same or higher permissions than privileged system processes on the device.
• Confidentiality impact is high on both the vulnerable component and all connected system components, meaning the attacker reads stored data including credentials, session tokens, and application data.
• Integrity impact is high across vulnerable and downstream system components, meaning the attacker modifies persisted data, application state, and system configuration.
• Availability impact is high across the vulnerable component and connected system components, meaning the attacker crashes or renders unresponsive the affected service and dependent services.