CVE-2026-107153
Description
A flaw was found in Rakuten Mobile smartphones. The devices utilize default Android Open Source Project (AOSP) test cryptographic keys for Android Verified Boot (AVB), which validates operating system integrity during device startup. An attacker with physical access can exploit this flaw to bypass secure boot verification and install a crafted system image. This can enable arbitrary code execution with full device privileges and compromise stored sensitive data.
Statement
This vulnerability is rated as Moderate because exploitation strictly requires physical access to the target hardware. The issue is limited to Android Verified Boot configuration on third-party Rakuten Mobile devices and does not affect any Red Hat products or enterprise offerings.
Understanding the Weakness (CWE)
Authentication
Technical Impact: Gain Privileges or Assume Identity
If admins do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple organizations.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
