Is CVE-2026-54318 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54318 being exploited in the wild.

How severe is CVE-2026-54318?

High severity, with a CVSS score of 7.1, published 23 June 2026.

Which products and versions are affected?

Home Assistant Companion app (Android) <= 2026.5.2.

Is there a fix for CVE-2026-54318?

A patch was published on 2026-05-11: Fix merged in GitHub pull request #6837 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54318 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-54318?

Check whether you run Home Assistant Companion app (Android) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54318: Home Assistant Companion for Android location spoofing in LocationSensorManager

Q: Is there a fix for CVE-2026-54318?

A patch was published on 2026-05-11: Fix merged in GitHub pull request #6837 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54318 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-54318?

Check whether you run Home Assistant Companion app (Android) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54318 · Severity: high · CVSS 7.1 · Published 2026-06-23

Home Assistant is a popular smart home platform used to control devices like locks, alarms, and garage doors. A security flaw in its Android mobile app allows a malicious app installed on the same phone to fake the user's GPS location. This could trick the smart home system into thinking the owner has arrived home, potentially triggering automations that automatically unlock doors or disarm security systems.

Vendors: Home Assistant.

Quick answers

Is CVE-2026-54318 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54318 being exploited in the wild.
How severe is CVE-2026-54318?: High severity, with a CVSS score of 7.1, published 23 June 2026.
Which products and versions are affected?: Home Assistant Companion app (Android) <= 2026.5.2.
Is there a fix for CVE-2026-54318?: A patch was published on 2026-05-11: Fix merged in GitHub pull request #6837 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54318 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-54318?: Check whether you run Home Assistant Companion app (Android) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The LocationSensorManager BroadcastReceiver in the Home Assistant Companion app for Android was improperly exported without required permissions (CWE-926). This allowed any locally installed application, even those with no runtime permissions, to send a forged 'LocationResult' Intent directly to the receiver. The app trusted these coordinates and forwarded them to the Home Assistant server as legitimate device location data. This bypasses Android's 'Mock Location' security controls and can be used to manipulate zone-based automations. The issue is resolved in version 2026.5.3 by setting the receiver to non-exported and introducing a validated proxy for legitimate external requests.

Affected products

Home Assistant Companion app (Android) <= 2026.5.2

Timeline

2026-05-11: patched: Fix merged in GitHub pull request #6837
2026-06-17: advisory: Project advisory GHSA-77r5-pw5w-mgj3 published
2026-06-23: disclosed: CVE-2026-54318 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.