Critical Zero-Click Android Flaw Grants Remote Shell Access Without Interaction

Google's May 2026 Android Security Bulletin discloses CVE-2026-0073, a critical logic flaw in the adbd TLS verification for wireless ADB that can be exploited by a proximal attacker to achieve zero-click remote code execution as the shell user on Android 14–16; users should apply security patches with security patch level 2026-05-01 or later immediately.