CVE-2026-54318 Overview
CVE-2026-54318 affects the Home Assistant Android companion app prior to version 2026.5.3. The LocationSensorManagerBroadcastReceiver is exported without permission enforcement [CWE-926]. Any locally installed application, even one holding zero runtime permissions, can broadcast a forged Google Play Services LocationResult intent to the receiver. The receiver trusts the extra data and forwards the spoofed coordinates to the user's Home Assistant server as the device's real location. The flaw bypasses Android's developer-mode Mock Location restriction and enables abuse of zone-based automations.
Critical Impact
A local malicious app can fake GPS position to trigger zone-based automations such as unlocking doors, disarming alarms, or opening garage doors.
Affected Products
- Home Assistant Android companion app versions prior to 2026.5.3
- Home Assistant deployments relying on Android device GPS for zone-based automation
- Home Assistant integrations consuming device_tracker data from the Android app
Discovery Timeline
- 2026-06-23 - CVE-2026-54318 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-54318
Vulnerability Analysis
The Home Assistant Android companion app registers LocationSensorManager as a BroadcastReceiver to ingest location updates from Google Play Services. The receiver is declared exported and does not require a custom signature-level permission. Android treats any exported receiver without a permission guard as accessible to all installed applications on the device. The receiver accepts a LocationResult payload from the incoming intent extra and forwards the parsed coordinates to the configured Home Assistant server. No verification confirms the sender is the legitimate Google Play Services package.
Root Cause
The root cause is improper export of an Android component carrying sensitive functionality [CWE-926]. The manifest entry for LocationSensorManager exposes the receiver to cross-application intent delivery. Trusted-source validation is absent in the receiver code path. The handler deserializes the LocationResult extra and emits it to the backend without confirming the broadcasting UID or package signature. This violates Android's intent-sender authentication best practices.
Attack Vector
An attacker publishes or sideloads a benign-appearing Android application requesting no runtime permissions. The app constructs an explicit intent targeting the Home Assistant receiver and attaches a crafted LocationResult extra containing arbitrary latitude and longitude. Android delivers the broadcast, and the Home Assistant app reports the fabricated coordinates to the configured server. Zone-based automations evaluate the spoofed position as legitimate presence. The technique bypasses the Mock Location developer toggle because no real LocationManager provider is involved.
The vulnerability mechanism is described in the GitHub Security Advisory GHSA-77r5-pw5w-mgj3 and the corresponding Home Assistant Android Pull Request 6837.
Detection Methods for CVE-2026-54318
Indicators of Compromise
- Sudden, physically implausible jumps in reported device location coordinates that resolve directly inside an automation zone
- Location updates arriving without corresponding movement entries in the Android device's GPS provider history
- Zone-trigger automations firing while the device's actual cellular or Wi-Fi network context does not match the reported zone
Detection Strategies
- Audit installed Android applications on devices running the Home Assistant companion app and flag any third-party app declaring receivers or services that send broadcasts to io.homeassistant.companion.android
- Correlate Home Assistant device_tracker state changes with Android battery, network, and motion sensor telemetry to identify location updates without matching movement signals
- Review Home Assistant logbook entries for repeated zone entry/exit events lacking transitional waypoints
Monitoring Recommendations
- Enable verbose logging for the LocationSensorManager component and ship logs to a centralized SIEM for behavioral analysis
- Alert on Home Assistant automations that perform high-impact actions such as lock.unlock, alarm_control_panel.alarm_disarm, or cover.open_cover triggered by zone events
- Monitor the Android companion app version across managed devices and alert on any device still running a build prior to 2026.5.3
How to Mitigate CVE-2026-54318
Immediate Actions Required
- Upgrade the Home Assistant Android companion app to version 2026.5.3 or later on every device that reports location data
- Temporarily disable high-impact zone-based automations such as door unlock and alarm disarm until all client devices are patched
- Review installed applications on Android devices linked to Home Assistant and remove untrusted third-party apps
Patch Information
The issue is fixed in Home Assistant Android companion app 2026.5.3. The patch adds permission enforcement to the LocationSensorManager receiver and validates the sender of incoming LocationResult broadcasts. Patch details are available in Home Assistant Android Pull Request 6837.
Workarounds
- Disable the Location sensor in the Home Assistant Android companion app settings until the device can be updated
- Replace single-factor zone automations with multi-factor conditions that also require network presence, NFC tag scan, or explicit user confirmation
- Restrict installation of unverified APKs on devices used as Home Assistant location sources by enforcing a managed Google Play allowlist
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
