{"id":"CVE-2026-0053","kind":"vulnerability","aliases":["CVE-2026-0053"],"related":[],"title":"Android: a primary user can disable NFC for other users","description":"In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A primary Android user can disable secure NFC for other full users because user isolation is insufficient. This gives local privilege escalation with no extra execution privileges and no user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","multi-user","runtime"],"not_affected_if":["no-secondary-users","single-user-device"],"how_to_check":"- Check the Android security patch level under Settings > About phone > Android version, or run `adb shell getprop ro.build.version.security_patch` on a connected device\n- Check whether the device has multiple full user profiles with `adb shell pm list users`","fix":null,"status":"open","published_at":"2026-11-02T20:17:23+00:00","first_seen_at":"2026-11-02T20:35:25+00:00","triaged_at":"2026-11-02T20:40:56+00:00","updated_at":"2026-11-02T20:40:56+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-02T20:40:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: a primary user can disable NFC for other users","impact":"medium","summary":"A primary Android user can disable secure NFC for other full users because user isolation is insufficient. This gives local privilege escalation with no extra execution privileges and no user interaction.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android","mobile","multi-user"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"A local user escalates privileges and disables NFC for others.","analyst_note":"Confirm affected Android versions and the patched security bulletin month from the Android Security Bulletin; NVD text alone does not name them.","how_to_check":"- Check the Android security patch level under Settings > About phone > Android version, or run `adb shell getprop ro.build.version.security_patch` on a connected device\n- Check whether the device has multiple full user profiles with `adb shell pm list users`","plain_action":"Install the latest Android security update on your phone or tablet from Settings > System > Software update.","needs_analyst":true,"not_affected_if":["single-user-device","no-secondary-users"],"who_is_affected":"Android devices with more than one full user profile are exposed, since the flaw lets the primary user affect other full users. Single-user devices and devices without multiple profiles are unlikely to be affected. The sources do not name affected Android versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4095,"output_tokens":524,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0053':13A,16A '-2026':12A,15A 'addit':91C 'android':1A,17B,25B,79C 'could':82C 'cve':11A,14A 'disabl':6A,28B,67C 'due':74C 'escal':44B,86C 'execut':48B,92C 'exploit':101C 'extra':47B 'full':33B,72C 'give':41B 'insuffici':39B,76C 'interact':53B,96C 'isol':37B,77C 'lead':83C 'local':42B,85C 'locat':56C 'method':61C 'mobil':18B 'multi':20B 'multi-us':19B 'multipl':55C 'need':94C,99C 'nfc':7A,30B,69C 'possibl':60C 'primari':3A,24B,64C 'privileg':43B,49B,88C,93C 'runtim':22B 'secur':29B,68C 'user':4A,10A,21B,26B,34B,36B,52B,65C,73C,80C,95C","nicknames":[],"mitigations":[],"who_affected":"Android devices with more than one full user profile are exposed, since the flaw lets the primary user affect other full users. Single-user devices and devices without multiple profiles are unlikely to be affected. The sources do not name affected Android versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","mobile","multiuser","runtime","unknown"],"first_public_at":"2026-11-02T20:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0053","severity":null,"published_at":"2026-11-02T20:17:23+00:00","modified_at":"2026-11-02T20:17:23+00:00","first_seen_at":"2026-11-02T20:35:25+00:00","fetched_at":"2026-11-02T20:35:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}