InfoSecBulletin Cybersecurity for mankind
Google has released the May 2026 Android Security Bulletin, warning everyone about a critical remote code execution (RCE) flaw. Tracked as CVE-2026-0073, this serious flaw is found in the core part of the Android System. It lets a bad actor to get remote shell access without needing the device owner to do anything.
Threat actors can make this zero-click attack from nearby, which means they just need to be on the same local network or close to a weak mobile device.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Android Zero-Click Vulnerability
The main issue of CVE-2026-0073 is in the adbd part, which stands for the Android Debug Bridge daemon. Developers usually use this system service to talk to a device, run terminal commands, and change how the system works.
The flaw lets attackers run remote code as a “shell” user, so they can get around normal app security. They do not need special permissions or user action to launch their harmful programs successfully.
Imagine the adbd service as a restricted maintenance door on a secure corporate building.This flaw is like a key that opens things wirelessly, letting a bad person unlock the door and control the building’s systems without the guard seeing it.
The adbd service is part of Project Mainline and is updated through Google Play. This issue affects many recent versions of the operating system.
Android 14, Android 15, Android 16, and Android 16-QPR2 devices are currently at risk.
Google fixed this flaw in the May 1, 2026, security update explained in the Android Security Bulletin May 2026. All Android device makers were told about this issue at least a month early to help them get ready for online firmware updates.
Source code updates are also being added to the Android Open Source Project (AOSP) to keep the platform stable for everyone.
To make sure a device is safe, go to system settings and check if the security patch level is May 1, 2026, or newer. Users should also check for Google Play system updates themselves. Some devices with Android 10 or newer might get special updates this way.
