Executive brief
Android's NFC Service is a system component that manages near-field communication capabilities on Android devices, enabling contactless payment and data exchange. A missing permission check in this service allows a local attacker to hijack NFC payment sessions, leading to unauthorized access and potential financial fraud without requiring special privileges or user interaction.
Technical details
This vulnerability is a privilege escalation (EoP) issue in multiple functions of NfcService.java, stemming from a missing permission check that fails to validate caller permissions before allowing access to sensitive NFC operations. The attack vector is local, requiring code execution on the device but no additional execution privileges. An attacker can exploit this to hijack silent payment sessions—intercepting or rerouting NFC transactions to unauthorized recipients. The vulnerability affects Android versions 14 through 17 and is addressed by security patch level 2026-09-05 or later; patches have been released to AOSP.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched