Android Wireless ADB Mutual Authentication Bypass Vulnerability Allowing Remote Code Execution

A logic error in the Android Debug Bridge (ADB) over TLS mutual authentication process can be exploited to bypass authentication. This vulnerability allows for remote code execution as the shell user, without requiring additional execution privileges or user interaction. It affects devices with Android security patch levels prior to 2026-05-01.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution as the shell user.

Remediation

Users can update their devices to the 2026-05-01 security patch level to address this vulnerability. Instructions for checking and updating the Android version are available on the Google Support website.