CVE-2026-0084 Overview
CVE-2026-0084 is a local privilege escalation vulnerability in the Android HostEmulationManager.java component. A logic error across multiple functions allows an unprivileged application to launch background activities that should be restricted. Successful exploitation grants elevated privileges without additional execution rights or user interaction. The flaw is tracked under [CWE-693: Protection Mechanism Failure] and affects the Near Field Communication (NFC) host card emulation subsystem in Android. Google addressed the issue in the September 2026 Android Security Bulletin.
Critical Impact
A local, low-privileged application can escalate to higher privileges by launching background activities that bypass Android's activity-launch restrictions, with no user interaction required.
Affected Products
- Android Open Source Project (AOSP) — HostEmulationManager.java in the NFC stack
- Android devices pending the September 2026 security patch level (2026-09-01)
- OEM Android builds that include the vulnerable HostEmulationManager component
Discovery Timeline
- 2026-09-08 - CVE-2026-0084 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-0084
Vulnerability Analysis
The vulnerability resides in HostEmulationManager.java, a component of the Android NFC service that manages host card emulation (HCE) routing between the NFC controller and applications. Multiple functions in this class contain a logic error that permits background activity launches under conditions that should reject them.
Android enforces background activity launch (BAL) restrictions to prevent apps from starting UI activities while not in the foreground. When these restrictions are bypassed, a malicious app can render activities on top of trusted apps, enabling task hijacking, tapjacking, and credential capture flows that translate into privilege escalation.
Root Cause
The root cause is an incorrect authorization check in the HostEmulationManager code path that decides whether to dispatch an activity in response to NFC events. Because the check does not correctly evaluate the caller's foreground state or the launch context, a background component can trigger an activity launch that Android's protection mechanism would otherwise deny. This maps to [CWE-693: Protection Mechanism Failure].
Attack Vector
Exploitation requires local access with low privileges, such as an installed application on the device. The attacker crafts an application that interacts with the NFC host emulation subsystem to reach the vulnerable code paths. Once the logic error is triggered, the app launches an activity into the foreground without user interaction and inherits access to UI contexts and interactions that were not intended for it. Refer to the Android Security Bulletin September 2026 for the vendor's technical description.
Detection Methods for CVE-2026-0084
Indicators of Compromise
- Unexpected activity launches originating from apps that are not in the foreground, particularly following NFC events.
- Installed applications requesting NFC or HCE permissions that have no legitimate business function requiring them.
- Anomalous foreground transitions logged in ActivityTaskManager and NfcService around the same timestamps.
Detection Strategies
- Verify the Android security patch level on managed devices and flag any device below 2026-09-01.
- Inspect application manifests for combinations of android.permission.NFC and services extending HostApduService from unknown publishers.
- Correlate mobile threat defense telemetry for apps that trigger activity starts while reported as background processes.
Monitoring Recommendations
- Ingest Android device attestation and patch-level data into your SIEM to track exposure over time.
- Monitor enterprise app catalogs and sideload events for new NFC-capable applications.
- Alert on repeated HostEmulationManager or NFC service errors in logcat collected via mobile device management (MDM) diagnostics.
How to Mitigate CVE-2026-0084
Immediate Actions Required
- Update all Android devices to a security patch level of 2026-09-01 or later.
- Enforce minimum patch-level policies through your MDM or unified endpoint management platform and block noncompliant devices from corporate resources.
- Audit installed applications with NFC permissions and remove any that are unnecessary or untrusted.
Patch Information
Google published the fix in the September 2026 Android Security Bulletin. Device manufacturers ship the corresponding update at security patch level 2026-09-01 or later. Consult the Android Security Bulletin September 2026 for the authoritative list of fixed components and OEM guidance.
Workarounds
- Disable NFC on devices that do not require it, either through user settings or MDM policy.
- Restrict application installation to vetted enterprise app stores until the patch is deployed.
- Apply conditional access policies that quarantine devices reporting a pre-September 2026 patch level.
# Example MDM policy check for Android patch level
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
