CVE-2026-0082: In tryStartActivity of NfcDispatcher

Synopsis

This is a privilege escalation vulnerability in the NfcDispatcher component of Android 17, specifically in the tryStartActivity method of NfcDispatcher.java. Despite the CVSS 4.0 vector indicating network-reachable conditions, the description confirms the practical attack path involves automatic special app access permission assignment triggered by an insecure default value, enabling local privilege escalation without any additional privileges or user interaction. Successful exploitation gives an attacker full control over the device, including read and write access to all data and the ability to disrupt services. No fix version has been published yet; HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The CVSS 4.0 vector specifies AV:N, meaning the vulnerable component is reachable over the network without requiring physical or local access.

• AuthenticationNot required

  PR:N indicates no credentials or account privileges are needed before triggering the vulnerability.

• Victim interactionNot required

  UI:N confirms no user action such as clicking a link or opening a file is required for exploitation.

• Attack complexityDetail

  AC:L with AT:N means the exploit is reliable and condition-free, requiring no race conditions, special configurations, or environmental prerequisites.

Blast Radius

• Reads all data on the device, including stored credentials, session tokens, and application data across every installed app.
• Writes or modifies any persisted data on the device, including system settings and application storage.
• Crashes or disrupts any running service on the device, including system-level processes.
• Gains equivalent impact on systems the compromised device can reach, as indicated by the high Subsequent System confidentiality, integrity, and availability scores in the CVSS 4.0 vector.