An Android BroadcastReceiver named LocationSensorManager in Home Assistant was exported without a required permission. Any app on the device can send a crafted Intent containing a Google Play Services LocationResult, and the receiver unconditionally trusts the payload, forwarding it to the Home Assistant server as the device’s real location. The flaw, classified as CWE‑926, allows an attacker to spoof geographic coordinates and manipulate zone‑based automations such as unlocking doors, disarming alarms, or opening garages. The result is a severe compromise of the user’s physical environment because the application cannot distinguish authentic GPS data from forged input.

All installations of the Home Assistant Android client earlier than version 2026.5.3 are affected. The vulnerability exists in the core component of the open‑source platform and impacts any device running the buggy client, regardless of the server instance’s configuration.

The CVSS score of 7.1 indicates moderate‑to‑high severity. EPSS is not available, and the vulnerability is not listed in the Citation requires local presence on the device; a malicious app with no runtime permissions can broadcast a fake location. Once the broadcast is accepted, the attacker can induce realistic automation triggers, effectively compromising the integrity of the user’s secured spaces.