CVE-2026-0083: In Nfc::eventCallback() of Nfc

Synopsis

Use-after-free vulnerability in the NFC event callback handler (Nfc::eventCallback() in Nfc.h) of Google Android 17 allows a local attacker to exploit a race condition by triggering a freed memory region to be re-accessed. No authentication or user interaction is required. Successful exploitation grants the attacker local escalation of privilege, giving full control over the affected process and potentially the underlying system. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; the vulnerability is exploited locally, not over a network connection.

• AuthenticationNot required

  No account credentials or elevated permissions are required; any process running on the device can attempt exploitation.

• Victim interactionNot required

  Exploitation requires no action from any user on the device; the attacker can trigger the race condition entirely autonomously.

• Attack complexityDetail

  The CVSS vector specifies AC:L and AT:N, meaning the exploit is reliable and requires no specific environmental conditions or timing prerequisites beyond triggering the race condition.

Blast Radius

• Attacker gains escalated local privileges, allowing execution of arbitrary code at a higher permission level than the originating process.
• Confidential data accessible to privileged system processes, including NFC transaction payloads and system credentials, becomes readable by the attacker.
• The attacker can write to or corrupt system state, modifying persisted configuration, security policy files, or application data on the device.
• The NFC subsystem and dependent services can be crashed or destabilized, disrupting contactless payment, access-control, and data-exchange functionality.