Google: Critical Android Zero-Click Vulnerability Grants Remote Shell Access

Google Patches Critical Zero-Click Android RCE Vulnerability in May 2026 Update

Google has disclosed a severe remote code execution (RCE) vulnerability in Android, tracked as CVE-2026-0073, which allows attackers to gain unauthorized access to devices without any user interaction. The flaw, rated critical, resides in the Android Debug Bridge daemon (adbd), a core system component used by developers for device communication and command execution.

Exploiting this vulnerability requires only proximity to the target device either on the same local network or within physical range making it a zero-click attack that bypasses traditional security measures. Once exploited, attackers can execute arbitrary code with "shell" user privileges, evading application sandboxes and gaining deep system access.

The issue affects Android 14, 15, 16, and 16-QPR2, as adbd is a Project Mainline component distributed via Google Play system updates. Google addressed the flaw in the May 1, 2026, security patch, with hardware partners notified in advance to prepare over-the-air (OTA) updates. Patches have also been released to the Android Open Source Project (AOSP) to ensure broader ecosystem security.

Users are advised to verify their device’s security patch level is May 1, 2026, or later and check for pending Google Play system updates, particularly on devices running Android 10 or newer. The fix mitigates a high-risk threat, as the flaw’s zero-click, proximity-based nature makes it an attractive target for advanced threat actors.

Source: https://cybersecuritynews.com/android-zero-click-vulnerability/

Android cybersecurity rating report: https://www.rankiteo.com/company/android_by_google

"id": "AND1777969476",
"linkid": "android_by_google",
"type": "Vulnerability",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Users of Android 14, 15, 16, '
                                              'and 16-QPR2',
                        'industry': 'Technology',
                        'location': 'Global',
                        'name': 'Google Android',
                        'type': 'Operating System'}],
 'attack_vector': 'Proximity-based (local network or physical range)',
 'customer_advisories': 'Users are advised to verify their device’s security '
                        'patch level is May 1, 2026, or later and check for '
                        'pending Google Play system updates.',
 'date_publicly_disclosed': '2026-05-01',
 'date_resolved': '2026-05-01',
 'description': 'Google has disclosed a severe remote code execution (RCE) '
                'vulnerability in Android, tracked as CVE-2026-0073, which '
                'allows attackers to gain unauthorized access to devices '
                'without any user interaction. The flaw resides in the Android '
                'Debug Bridge daemon (adbd), a core system component used by '
                'developers for device communication and command execution. '
                'Exploiting this vulnerability requires only proximity to the '
                'target device either on the same local network or within '
                'physical range, making it a zero-click attack. Once '
                "exploited, attackers can execute arbitrary code with 'shell' "
                'user privileges, evading application sandboxes and gaining '
                'deep system access.',
 'impact': {'operational_impact': 'Unauthorized code execution with shell '
                                  'privileges, evasion of application '
                                  'sandboxes',
            'systems_affected': 'Android devices (versions 14, 15, 16, and '
                                '16-QPR2)'},
 'investigation_status': 'Resolved',
 'post_incident_analysis': {'corrective_actions': 'Security patch released, '
                                                  'OTA updates distributed, '
                                                  'AOSP patches applied',
                            'root_causes': 'Vulnerability in Android Debug '
                                           'Bridge daemon (adbd)'},
 'recommendations': 'Users should verify their device’s security patch level '
                    'is May 1, 2026, or later and check for pending Google '
                    'Play system updates, particularly on devices running '
                    'Android 10 or newer.',
 'references': [{'source': 'Google Security Bulletin'}],
 'response': {'communication_strategy': 'Public disclosure of vulnerability '
                                        'and patch availability',
              'containment_measures': 'Security patch released in May 2026 '
                                      'update',
              'recovery_measures': 'Users advised to verify security patch '
                                   'level and install updates',
              'remediation_measures': 'Google Play system updates, OTA updates '
                                      'from hardware partners, AOSP patches'},
 'title': 'Google Patches Critical Zero-Click Android RCE Vulnerability in May '
          '2026 Update',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-0073 (Android Debug Bridge daemon - '
                            'adbd)'}