CVE-2026-54318

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54318", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T18:42:02.223Z", "datePublished": "2026-06-23T17:40:28.853Z", "dateUpdated": "2026-06-24T13:35:52.252Z"}, "containers": {"cna": {"title": "Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location", "problemTypes": [{"descriptions": [{"cweId": "CWE-926", "lang": "en", "description": "CWE-926: Improper Export of Android Application Components", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3"}, {"name": "https://github.com/home-assistant/android/pull/6837", "tags": ["x_refsource_MISC"], "url": "https://github.com/home-assistant/android/pull/6837"}], "affected": [{"vendor": "home-assistant", "product": "core", "versions": [{"version": "< 2026.5.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T17:40:28.853Z"}, "descriptions": [{"lang": "en", "value": "Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services LocationResult directly to it; the receiver trusts the extra and forwards it to the user's Home Assistant server as the device's real location. This bypasses Android's developer-mode \"Mock Location\" gate and allows a local malicious app to drive zone-based automations (unlock door / disarm alarm / open garage) by faking the user's GPS position. This vulnerability is fixed in 2026.5.3."}], "source": {"advisory": "GHSA-77r5-pw5w-mgj3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-24T13:35:30.887367Z", "id": "CVE-2026-54318", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T13:35:52.252Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54318", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T13:35:30.887367Z"}}}], "references": [{"url": "https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T13:35:40.491Z"}}], "cna": {"title": "Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location", "source": {"advisory": "GHSA-77r5-pw5w-mgj3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "home-assistant", "product": "core", "versions": [{"status": "affected", "version": "< 2026.5.3"}]}], "references": [{"url": "https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3", "name": "https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/home-assistant/android/pull/6837", "name": "https://github.com/home-assistant/android/pull/6837", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services LocationResult directly to it; the receiver trusts the extra and forwards it to the user's Home Assistant server as the device's real location. This bypasses Android's developer-mode \"Mock Location\" gate and allows a local malicious app to drive zone-based automations (unlock door / disarm alarm / open garage) by faking the user's GPS position. This vulnerability is fixed in 2026.5.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-926", "description": "CWE-926: Improper Export of Android Application Components"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T17:40:28.853Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54318", "state": "PUBLISHED", "dateUpdated": "2026-06-24T13:35:52.252Z", "dateReserved": "2026-06-12T18:42:02.223Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-23T17:40:28.853Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "core", "vendor": "home-assistant", "versions": [{"status": "affected", "version": "< 2026.5.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:home-assistant:home_assistant_companion:*:*:*:*:*:android:*:*", "matchCriteriaId": "6AA860BB-ADB1-4C7E-B0F6-A56ECBF770B2", "versionEndExcluding": "2026.5.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services LocationResult directly to it; the receiver trusts the extra and forwards it to the user's Home Assistant server as the device's real location. This bypasses Android's developer-mode \"Mock Location\" gate and allows a local malicious app to drive zone-based automations (unlock door / disarm alarm / open garage) by faking the user's GPS position. This vulnerability is fixed in 2026.5.3."}, {"lang": "es", "value": "Home Assistant es un software de automatizaci\u00f3n del hogar de c\u00f3digo abierto que prioriza el control local y la privacidad. Antes de la versi\u00f3n 2026.5.3, el BroadcastReceiver LocationSensorManager se exporta sin ning\u00fan permiso. Cualquier aplicaci\u00f3n instalada, sin permisos de tiempo de ejecuci\u00f3n, puede transmitir un LocationResult falsificado de Google Play Services directamente a este; el receptor conf\u00eda en el extra y lo reenv\u00eda al servidor de Home Assistant del usuario como la ubicaci\u00f3n real del dispositivo. Esto elude la puerta de \u2019Ubicaci\u00f3n simulada\u2019 del modo de desarrollador de Android y permite que una aplicaci\u00f3n maliciosa local impulse automatizaciones basadas en zonas (desbloquear puerta / desarmar alarma / abrir garaje) al falsificar la posici\u00f3n GPS del usuario. Esta vulnerabilidad se corrige en la versi\u00f3n 2026.5.3."}], "id": "CVE-2026-54318", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54318", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-24T13:35:30.887367Z", "version": "2.0.3"}}]}, "published": "2026-06-23T18:18:08.890", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/home-assistant/android/pull/6837"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory", "Mitigation"], "url": "https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory", "Mitigation"], "url": "https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-926"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.5.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "core", "source": "cna", "vendor": "home-assistant"}, "product": "core", "vendor": "home-assistant"}], "created": "2026-06-23T21:30:07.304155+00:00", "updated": "2026-06-24T10:30:14.696902+00:00", "vendors": ["home-assistant", "home-assistant$PRODUCT$core"]}