In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.
Fix
Public exploits 16
- 0xBlackash/CVE-2026-0073 PoC on GitHub
- 0xbinder/CVE-2026-0073 PoC on GitHub
- MartinPSDev/CVE-2026-0073-Android-ADBD-bypass-POC PoC on GitHub
- SecTestAnnaQuinn/CVE-2026-0073-Android-adbd-authentication-bypass-POC PoC on GitHub
- adityatelange/poc-CVE-2026-0073 PoC on GitHub
- aye468448-eng/CVE-2026-0073-Android-adbd-authentication-bypass PoC on GitHub
- ctn-Qvo/CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN PoC on GitHub
- fredevsec/CVE-2026-0073 PoC on GitHub
- m00ddy/CVE-2026-0073-Android-client-TLS-auth-bypass PoC on GitHub
- naheeju/POC-CVE-2026-0073 PoC on GitHub
- novaek/CVE-2026-0073-Research PoC on GitHub
- tc4dy/CVE-2026-0073-PoC-Exploit PoC on GitHub
- umarrehmansiddiqui/CVE-2026-0073 PoC on GitHub
- unnaim/adbHijacker PoC on GitHub
- xqi1337/CVE-2026-0073-Android-ADBD-bypass-POC PoC on GitHub
- xqi1337/poc-CVE-2026-0073 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.8 · googleNVD modified 2026-10-26 19:10
Affected (CPE criteria) 6
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*