Executive brief
Home Assistant is a popular smart home platform used to control devices like locks, alarms, and garage doors. A security flaw in its Android mobile app allows a malicious app installed on the same phone to fake the user's GPS location. This could trick the smart home system into thinking the owner has arrived home, potentially triggering automations that automatically unlock doors or disarm security systems.
Technical details
The LocationSensorManager BroadcastReceiver in the Home Assistant Companion app for Android was improperly exported without required permissions (CWE-926). This allowed any locally installed application, even those with no runtime permissions, to send a forged 'LocationResult' Intent directly to the receiver. The app trusted these coordinates and forwarded them to the Home Assistant server as legitimate device location data. This bypasses Android's 'Mock Location' security controls and can be used to manipulate zone-based automations. The issue is resolved in version 2026.5.3 by setting the receiver to non-exported and introducing a validated proxy for legitimate external requests.
Affected products
- Home Assistant Companion app (Android) <= 2026.5.2
Timeline
- 2026-05-11: patched: Fix merged in GitHub pull request #6837
- 2026-06-17: advisory: Project advisory GHSA-77r5-pw5w-mgj3 published
- 2026-06-23: disclosed: CVE-2026-54318 published to NVD