{"id":12787,"date":"2026-05-12T10:04:02","date_gmt":"2026-05-12T10:04:02","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/05\/12\/poc-exploit-released-for-android-zero-click-vulnerability-that-enables-remote-shell-access\/"},"modified":"2026-05-12T10:04:02","modified_gmt":"2026-05-12T10:04:02","slug":"poc-exploit-released-for-android-zero-click-vulnerability-that-enables-remote-shell-access","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/05\/12\/poc-exploit-released-for-android-zero-click-vulnerability-that-enables-remote-shell-access\/","title":{"rendered":"PoC Exploit Released for Android Zero-Click Vulnerability that Enables Remote Shell Access"},"content":{"rendered":"

PoC Exploit Released for Android Zero-Click Vulnerability that Enables Remote Shell Access
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

In a chilling blow to mobile security, Google\u2019s May 2026 Android Security Bulletin has unmasked a catastrophic zero-click vulnerability lurking within the core Android System.<\/p>\n

The CVE-2026-0073 flaw in Android\u2019s adbd daemon<\/a> lets nearby threat actors remotely gain full shell access without victim interaction.<\/p>\n

Unearthed by BARGHEST security researchers, this critical cryptographic breakdown completely shatters Android\u2019s debugging trust model, transforming a standard developer tool into an invisible, weaponized backdoor.<\/p>\n

Android Zero-Click PoC Released<\/strong><\/h2>\n

The foundation of CVE-2026-0073 is a cryptographic logic error in the\u00a0adbd_tls_verify_cert<\/code>\u00a0function of the\u00a0auth.cpp\u00a0<\/code>file.<\/p>\n

Modern wireless ADB connections rely on mutual TLS authentication<\/a> to ensure that a connecting client is a previously paired and trusted host.<\/p>\n

During this handshake, the system uses the\u00a0EVP_PKEY_cmp<\/code>\u00a0API to compare the client\u2019s certificate public key against authorized RSA keys stored on the device.<\/p>\n

If an attacker supplies a non-RSA certificate, such as EC P-256 or Ed25519, the comparison API returns -1 to flag a cross-algorithm mismatch.<\/p>\n

Because the underlying C++ implementation treats all non-zero integers as a boolean success, the daemon incorrectly validates the attacker\u2019s mismatched certificate as a trusted host key.<\/p>\n

Consequently, threat actors can extract sensitive personal information, abuse package management to silently install malicious applications<\/a>, and manipulate system settings to stage further device exploitation.<\/p>\n

According to Barghest Research<\/a>, the vulnerability mainly affects Android 14, 15, and 16 devices under specific state conditions.<\/p>\n

Successful exploitation demands the following prerequisites:<\/p>\n