CVE-2026-28611

CVE-2026-28611 is a missing-authorization flaw (CWE-862) in multiple functions of Android's NfcService.java, where the absence of a required permission check allows a local application to silently enable a payment session hijack. The flaw is triggered locally, with no user interaction and no additional execution privileges needed, which is what makes the attack path practical for an unprivileged app already running on the device. A successful attacker gains the ability to interfere with or take over NFC payment sessions without the user's awareness, classified as local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). All Android devices shipping the affected NFC service are potentially affected, though the vendor has not published the specific affected version ranges in the available data. There is currently no known public proof of concept, no listing in CISA's KEV catalog, and a low EPSS score (0.1% probability of exploitation within 30 days), indicating no confirmed exploitation to date.

What to do: Apply the relevant Android security update as soon as it becomes available via the Android Security Bulletin, delivered through OEM/carrier over-the-air updates; verify your device's current security patch level under Settings > About phone. Until patched, users concerned about contactless payment abuse can disable NFC or Google Pay/contactless payments when not in use, and organizations should ensure managed/fleet devices are enrolled in patch-cadence policies. Note that a local attacker still requires malicious or compromised app code on the device, so avoiding untrusted app installs reduces practical risk.