0-Click RCE on Android

Critical vulnerability CVE-2026-0073 in Android ADB, an authentication bypass flaw in the TLS certificate verification of the adbd daemon, specifically in the adbd_tls_verify_cert function. The TLS certificate verification makes Wireless Debugging accept an attacker as if they were an already authorized computer, thus bypassing device security.

This vulnerability occurs in Android 14, 15, and 16. It can only be exploited if ADB on the Android device is active and Wireless Debugging is also active. With this, it is possible to invade any cell phone, TV Box (usually enabled by default), tablet, emulator, smartwatch, or Chromecast that is on the same network without needing physical contact.

node adb-bypass.js [port] node adb-bypass.js [port] [--cmd "your command"] [-v]