Critical Remote Code Execution Vulnerability Patched in Android
CVE-2026-0073 affects Android’s System component and it can be exploited without any user interaction.
Aggregated from SecurityWeek
This article was automatically aggregated from an external source. Content may be summarized.
Full Analysis
Google announced on Monday the release of an Android update patching a critical vulnerability that can be exploited for remote code execution.
The flaw, tracked as CVE-2026-0073, affects Android’s System component, allowing an attacker to exploit it to execute code as the shell user without additional execution privileges. User interaction is not required for exploitation.
The advisory reveals that the issue impacts ‘adbd’ (Android Debug Bridge daemon), a background process running on Android devices that manages communication between the device and a computer, facilitating debugging and shell access.
Google has informed users that no patches have been released this month for Wear OS, Pixel Watch, Android XR, and Android Automotive.
There is no indication that CVE-2026-0073 has been exploited in malicious attacks.
Only one Android vulnerability patched this year has been flagged as exploited in the wild.
Advertisement. Scroll to continue reading.
Several flaws were exploited in attacks last year, including CVE-2024-43093, CVE-2024-50302, CVE‑2025‑27038, CVE-2025-48543, and CVE-2025-38352.
Google announced last week that it has significantly increased maximum bug bounty payouts for Android device vulnerabilities, offering up to $1.5 million for a zero-click Pixel Titan M exploit with persistence.
Related: Microsoft Finds Vulnerability Exposing Millions of Android Crypto Wallet Users
Related: Google API Keys in Android Apps Expose Gemini Endpoints to Unauthorized Access
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
In cyber-physical systems (CPS), just one hour of downtime can outweigh an entire annual security budget. Learn how to master the Return on Security Investment (ROSI) to align security goals with the bottom-line priorities.
Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization.
Originally published by SecurityWeek
Original Source
SecurityWeek