CVE-2026-107153: Rakuten Mobile Privilege Escalation Flaw

CVE-2026-107153 is a privilege escalation vulnerability affecting Rakuten Mobile smartphones that use AOSP test keys for Android Verified Boot. This flaw allows attackers with physical access to install crafted system images. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-107153 Overview

CVE-2026-107153 affects multiple Rakuten Mobile smartphones that ship with Android Open Source Project (AOSP) test keys used for Android Verified Boot (AVB). Because the devices trust publicly known test signing keys, an attacker with physical access can install a crafted system image that still passes verified boot checks. The flaw is tracked under CWE-1391: Use of Weak Credentials and is documented in the JVN Vulnerability Report.

Critical Impact
An attacker with physical access can flash a malicious system image signed with the public AOSP test keys and bypass Android Verified Boot, compromising confidentiality, integrity, and availability of the device.

Affected Products

Discovery Timeline

2026-10-14 - CVE-2026-107153 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107153

Vulnerability Analysis

Android Verified Boot establishes a chain of trust from the bootloader through the system partition. Each stage verifies the next using a cryptographic signature anchored to keys fused into the device. The affected Rakuten Mobile smartphones were shipped using the AOSP test keys, which are published in the public Android source tree.

Because the trust anchor is public, any party can produce a system image whose signature validates against the device-resident key. The device then boots the attacker-controlled image as if it were legitimate firmware. This defeats the integrity guarantees AVB is designed to provide and enables persistent, pre-boot compromise.

Root Cause

The root cause is the use of development or test cryptographic material in production builds. Signing keys intended only for AOSP engineering workflows were retained in the shipped device firmware, violating the principle that production trust anchors must be unique and non-public.

Attack Vector

Exploitation requires physical access to the handset and the ability to enter a flashing or recovery mode. An attacker builds a modified Android system image, signs it with the publicly available AOSP test keys, and writes it to the device. On reboot, AVB validates the signature against the embedded test key, trusts the image, and loads the attacker's code with full system privileges.

The vulnerability can be used to install persistent malware, spyware, or backdoored system services. It is particularly relevant to supply-chain, evil-maid, and lost-or-stolen device scenarios. No remote exploitation path is described in the advisory.

See the JVN Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-107153

Indicators of Compromise

Verified boot state reporting orange or yellow instead of green on devices that should be locked.
Unexpected changes to the system partition fingerprint or build properties such as ro.build.fingerprint and ro.boot.verifiedbootstate.
System binaries or APKs signed with public AOSP test certificates rather than the vendor production certificate.
Mismatches between the installed system image hash and the hash published on the official Rakuten Mobile support pages.

Detection Strategies

Enroll affected handsets in a mobile device management (MDM) or mobile threat defense (MTD) platform and query attestation attributes, including verified boot key hash and bootloader state.
Use Android Key Attestation to confirm that the device presents a production root of trust rather than a known AOSP test key.
Compare system partition hashes against vendor-published reference values after any physical custody change.

Monitoring Recommendations

Alert on devices whose remote attestation reports a non-production verified boot key.
Monitor for enterprise accounts enrolled from handsets with an unlocked or tampered boot state.
Track physical custody events for corporate-issued Rakuten Mobile devices and trigger re-attestation after loss, repair, or international travel.

How to Mitigate CVE-2026-107153

Immediate Actions Required

Inventory all Rakuten Big S, Rakuten Hand, Rakuten Hand 5G, and Rakuten Mini devices in the environment.
Restrict these devices from accessing sensitive corporate data, identity systems, and privileged applications until mitigations are in place.
Enforce strong device passcodes and disable developer options, OEM unlock, and USB debugging to raise the bar for physical attacks.
Treat any affected device that leaves user custody as potentially compromised and re-image or retire it.

Patch Information

At the time of publication, the advisory does not reference a firmware update that replaces the AOSP test keys with production signing keys. Consult the official vendor support pages for the latest guidance: Rakuten Big S, Rakuten Hand 5G, Rakuten Hand, and Rakuten Mini. Because the vulnerable trust anchor is embedded in device firmware, full remediation generally requires a vendor firmware update or device replacement.

Workarounds

Maintain strict physical control of affected devices and store them in tamper-evident conditions when not in use.
Deploy an MDM or MTD solution that performs continuous device attestation and quarantines devices failing verified boot checks.
Avoid using affected handsets for high-assurance workloads such as administrative access, mobile banking, or multi-factor authentication.
Where feasible, replace affected handsets with devices that ship with vendor-controlled production signing keys.

bash

# Verify boot state and attestation attributes on a managed Android device
adb shell getprop ro.boot.verifiedbootstate
adb shell getprop ro.boot.flash.locked
adb shell getprop ro.build.fingerprint