CVE-2026-28611: Android NFC Privilege Escalation Vulnerability

CVE-2026-28611 Overview

CVE-2026-28611 is a local privilege escalation vulnerability in the Android NfcService.java component. Multiple functions within the service lack proper permission checks, allowing a local attacker to silently hijack payment sessions. Exploitation requires no user interaction and no additional execution privileges beyond a local foothold on the device.

The flaw is categorized under [CWE-862] Missing Authorization. Google addressed the issue in the Android Security Bulletin dated September 2026.

Critical Impact
A local application without payment-related permissions can hijack Near Field Communication (NFC) payment sessions, leading to full compromise of confidentiality, integrity, and availability within the affected NFC subsystem.

Affected Products

Android Open Source Project (AOSP) — NfcService.java component
Android devices receiving patches prior to the 2026-09-01 security patch level
Original Equipment Manufacturer (OEM) Android builds incorporating the vulnerable NFC service

Discovery Timeline

2026-09-08 - CVE-2026-28611 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28611

Vulnerability Analysis

The vulnerability resides in multiple functions within the Android NfcService.java implementation. These functions expose operations that influence NFC payment session state without verifying that the calling application holds the required permission. A local application can invoke these code paths and enable payment session hijacking silently, without prompting the user.

Because the missing check is on the caller's permission, any process running on the device can reach the affected code paths. The result is a local escalation of privilege that grants an unprivileged app influence over payment functionality reserved for privileged system components.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Inter-Process Communication (IPC) entry points of NfcService. Android services must validate caller identity using mechanisms such as enforceCallingPermission or Unique Identifier (UID) checks before performing security-relevant actions. The affected functions omit this validation, allowing untrusted callers to reach privileged logic.

Attack Vector

Exploitation is local. A malicious application installed on the device binds to the exposed NFC service interface and calls the unprotected methods. No user interaction is required, and the caller does not need to hold NFC or payment permissions. Successful exploitation enables the attacker's app to enable or influence a payment session under the identity of the NFC service.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-28611

Indicators of Compromise

Installed applications that bind to the NFC service without holding declared NFC permissions in their manifest.
Unexpected NFC payment session state changes recorded in logcat under the NfcService tag when no user-initiated payment occurred.
Anomalous invocation of NFC service Application Programming Interfaces (APIs) from third-party package identifiers.

Detection Strategies

Inventory Android devices and confirm the security patch level is 2026-09-01 or later using Mobile Device Management (MDM) telemetry.
Perform static analysis of third-party Android Package Kits (APKs) for calls into android.nfc.INfcAdapter and related interfaces without declared permissions.
Correlate application install events with subsequent NFC service API activity to surface suspicious behavior.

Monitoring Recommendations

Forward Android logcat and MDM security posture events into a centralized analytics pipeline for baseline deviation analysis.
Alert on any application requesting NFC-related bindings that was not previously approved by application allowlisting policy.
Track patch level compliance across the mobile fleet and flag devices remaining below the September 2026 patch baseline.

How to Mitigate CVE-2026-28611

Immediate Actions Required

Apply the Android September 2026 security update (patch level 2026-09-01 or later) across all managed devices.
Restrict installation of untrusted applications via MDM policy and enforce Google Play Protect scanning.
Audit installed applications on high-value devices, particularly those used for payment or authentication, and remove unknown or unnecessary apps.

Patch Information

Google released a fix as part of the Android Security Bulletin for September 2026. Device manufacturers integrate this patch into their monthly updates. Refer to the Android Security Bulletin September 2026 for the source patch references and affected code paths.

Workarounds

Disable NFC on devices that do not require it through MDM configuration until the security patch is applied.
Enforce work profile separation so payment and enterprise workloads run isolated from personal applications.
Block sideloading of applications from unknown sources via device policy.

bash

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch

# Expected output should be 2026-09-01 or later
# 2026-09-01