Executive brief
A security vulnerability exists in the Near Field Communication (NFC) component of Android 17. This flaw could allow a malicious application already on the device to gain higher-level system permissions without any interaction from the user. Exploiting this could lead to unauthorized access to sensitive data or control over device functions.
Technical details
A use-after-free vulnerability exists in the Nfc::eventCallback() function within Nfc.h of the Android System component. The issue is rooted in a race condition (CWE-362) during concurrent execution using shared resources without proper synchronization. A local attacker can exploit this race condition to achieve escalation of privilege (EoP) to a higher execution context. No additional execution privileges or user interaction are required for exploitation. The vulnerability is addressed in the Android 17 security patch level 2026-07-01.
Affected products
- Google Android 17
Timeline
- 2026-06-16: advisory: Android 17 Security Release Notes published
- 2026-06-17: disclosed: NVD publication date