In adbd_tls_verify_cert of auth

CVE-2026-0073 is a logic bug in Android adbd's TLS client-certificate check inside adbd_tls_verify_cert() in auth.cpp. On affected Android 14, 15, 16, and 16-qpr2 builds before the 2026-05-01 security patch level, an attacker on the same local network can abuse the certificate-comparison mistake to bypass Wireless ADB mutual authentication and land an adb shell session as the shell user.

The raw technical impact is real, but the vendor-style severity overstates fleet-wide urgency. In practice this requires *adjacent-network reachability* plus *Wireless debugging to be enabled* on the target, which dramatically shrinks the reachable population in managed enterprise fleets; that is why this scores lower here than the 8.8 baseline, even though the bug is clean, no-click, and now publicly understood.

Why this verdict

• Start from 8.8 HIGH: adjacent-network, no-auth, no-click RCE is serious in a vacuum.
• Downward adjustment for attacker position: AV:A means the attacker must already be on the same local network path. That is not internet-reachable initial access; it implies physical proximity, guest Wi-Fi presence, or prior foothold on internal wireless.
• Downward adjustment for exposure population: the device must have *Wireless debugging enabled*. In real fleets that is a minority state, often concentrated in engineering, QA, kiosks, and lab devices rather than the whole 10,000-host estate.
• Downward adjustment for control friction: modern MDM baselines, client isolation, mDNS suppression, and restrictive corporate Wi-Fi all break or shrink discovery and reachability for ADB-over-Wi-Fi.
• Downward adjustment for blast radius: the payload lands as Android shell, not root. That still hurts, but it is materially less catastrophic than full system compromise.
• Upward adjustment for exploitability quality: the bug is deterministic, no-click, and public PoC reporting exists, so this is not a purely theoretical code-path issue.

Why not higher?

It is not higher because this is not a broadly reachable remote edge-service bug. The exploit chain depends on a niche administrative feature being enabled on the endpoint and on the attacker sharing the right network position, which compounds into a sharply reduced exposed population. The post-exploitation context is also shell, not root.

Why not lower?

It is not lower because the technical exploit path is clean once the prerequisites are met. No user interaction is required, the authentication boundary really is bypassed, and exposed developer or lab devices can be high-value pivots with sensitive test data, app builds, and privileged trust relationships.

1. Disable Wireless debugging — Turn off Wireless debugging anywhere it is not explicitly required, especially on developer handsets, QA pools, kiosks, and shared lab devices. For a MEDIUM verdict there is no noisgate mitigation SLA, so treat this as a hardening change in normal config cadence rather than an emergency push; still, it is the most effective exposure reducer because it removes the listening service entirely.
2. Enforce Developer Options restrictions via MDM — Use Android Enterprise policy to block or tightly scope Developer Options and debugging features on production-user devices. There is no mitigation SLA at MEDIUM, but pushing this control before the patch reaches the whole fleet prevents the vulnerable code path from being reachable in the first place.
3. Segment client Wi-Fi — Apply client isolation, mDNS suppression where operationally safe, and peer-to-peer restrictions on corporate wireless networks. This does not fix the bug, but it raises exploitation friction by breaking discovery and direct local reachability; implement during normal network-change windows since MEDIUM has no noisgate mitigation SLA.
4. Inventory ADB-exposed Android assets — Query internal exposure tools for Android devices speaking ADB, for example runZero's protocol:=adb AND os:Android, and hand that list to mobile/endpoint owners. Use it to target patch validation and policy cleanup ahead of the 365-day remediation window.

Run this on an auditor workstation with the Android adb client installed and a USB- or already-managed-ADB-connected target device. Invoke it as ./check-cve-2026-0073.sh <serial> or ./check-cve-2026-0073.sh for a single attached device; it needs enough access to run adb shell getprop, but does not require root on the phone.

#!/usr/bin/env bash
# check-cve-2026-0073.sh
# Determine likely exposure to CVE-2026-0073 based on Android version and security patch level.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_SERIAL="${1:-}"
ADB_BIN="${ADB_BIN:-adb}"
FIXED_SPL="2026-05-01"

adb_cmd() {
  if [[ -n "$TARGET_SERIAL" ]]; then
    "$ADB_BIN" -s "$TARGET_SERIAL" "$@"
  else
    "$ADB_BIN" "$@"
  fi
}

fail_unknown() {
  echo "UNKNOWN: $1"
  exit 2
}

normalize_date() {
  # Accept YYYY-MM-DD only.
  local d="$1"
  if [[ "$d" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
    echo "$d"
  else
    echo ""
  fi
}

# Ensure adb can see the target.
adb_cmd get-state >/dev/null 2>&1 || fail_unknown "adb cannot reach target device"

RELEASE_RAW="$(adb_cmd shell getprop ro.build.version.release 2>/dev/null | tr -d '\r')"
SPL_RAW="$(adb_cmd shell getprop ro.build.version.security_patch 2>/dev/null | tr -d '\r')"
PRODUCT_RAW="$(adb_cmd shell getprop ro.product.model 2>/dev/null | tr -d '\r')"
BUILD_RAW="$(adb_cmd shell getprop ro.build.fingerprint 2>/dev/null | tr -d '\r')"

[[ -n "$RELEASE_RAW" ]] || fail_unknown "missing ro.build.version.release"
SPL="$(normalize_date "$SPL_RAW")"

# Extract major Android release number (14, 15, 16, etc.).
MAJOR="${RELEASE_RAW%%.*}"
if ! [[ "$MAJOR" =~ ^[0-9]+$ ]]; then
  fail_unknown "unrecognized Android release: $RELEASE_RAW"
fi

# Affected releases from public advisory: 14, 15, 16 / 16-qpr2 track.
if (( MAJOR < 14 )); then
  echo "PATCHED: device is Android $RELEASE_RAW, outside the published affected range (14/15/16). Model=$PRODUCT_RAW"
  exit 0
fi

if (( MAJOR > 16 )); then
  echo "PATCHED: device is Android $RELEASE_RAW, newer than the published affected range. Model=$PRODUCT_RAW"
  exit 0
fi

if [[ -z "$SPL" ]]; then
  fail_unknown "missing or malformed security patch level on affected Android $RELEASE_RAW device"
fi

if [[ "$SPL" < "$FIXED_SPL" ]]; then
  echo "VULNERABLE: Android $RELEASE_RAW with security patch level $SPL is older than $FIXED_SPL. Model=$PRODUCT_RAW Fingerprint=$BUILD_RAW"
  exit 1
fi

echo "PATCHED: Android $RELEASE_RAW with security patch level $SPL meets or exceeds $FIXED_SPL. Model=$PRODUCT_RAW Fingerprint=$BUILD_RAW"
exit 0

Sources

1. Android Security Bulletin—May 2026
2. NVD entry for CVE-2026-0073
3. AOSP fix commit for bug 469080888
4. AOSP diff showing `EVP_PKEY_cmp` fix
5. Android Developers: ADB over Wi-Fi prerequisites
6. runZero: finding Android ADB on your network
7. FIRST EPSS data and methodology
8. CISA Known Exploited Vulnerabilities Catalog