Executive brief
A security flaw in the Android operating system's NFC component could allow a malicious application to automatically gain special access permissions without user consent. This occurs because of an insecure default setting in how the system handles certain app requests. An attacker could exploit this to escalate their privileges on a device, potentially gaining unauthorized access to sensitive data or system functions.
Technical details
A vulnerability exists in the 'tryStartActivity' method of 'NfcDispatcher.java' within the Android System component. The root cause is an insecure default variable initialization (CWE-453) that allows for the automatic assignment of special app access permissions. A local attacker can exploit this to achieve escalation of privilege (EoP) without requiring any additional execution privileges or user interaction. While the CNA provided a CVSS 4.0 score of 10.0 with a network attack vector, the technical description and Android security bulletin categorize this as a local escalation of privilege (EoP) issue. The vulnerability is addressed in Android 17 with security patch level 2026-07-01.
Affected products
- Google Android 17
Timeline
- 2026-06-16: advisory: Android 17 Security Release Notes published
- 2026-06-17: disclosed: NVD publication date