A logic error in the adbd_tls_verify_cert routine inside auth.cpp allows an attacker to bypass the wireless ADB mutual authentication handshake. Once the attacker succeeds, they can execute arbitrary code on the device’s shell user account without needing additional privileges or user interaction, achieving remote (proximal/adjacent) code execution.

The vulnerability affects any Android device with wireless ADB enabled, specifically builds that contain the affected adbd implementation. While the CVE itself does not list exact OS versions, the 2026‑05‑01 security bulletin enumerates the affected releases. All devices running those builds are therefore vulnerable.

With a CVSS score of 8.8, the flaw poses a high‑risk opportunity for attackers. The EPSS score is not available, and the vulnerability is not present in CISA’s KEV catalog, yet the lack of user interaction and proximity requirements make exploitation still a serious threat to any device that has wireless ADB active over an unprotected or partially protected network.