Android may restrict ADB within devices, potentially affecting developers of Shizuku, libadb, and other similar tools.
ADB (Android Debug Bridge) is a tool used for Android development and for using special features and applications. Changes to this tool are being considered, and there is a possibility that the methods for establishing an ADB connection on a single device may be limited. Developer Kitsumed explains the changes.
Android May Soon Restrict On-Device ADB, Affecting Shizuku, libadb and Developers | Kitsumed Blog
Google considers potential on-device ADB changes
The issue Kitsumed brought up was a feature request in progress on Google IssueTracker in which one of the core maintainers of ADB (a Google employee) mentioned a proposal to restrict the network interfaces used by ADB servers as a countermeasure against malicious attacks.
ADB was originally designed exclusively for USB connections, but its usage has since been expanded to include TCP/IP and Wi-Fi (wireless debugging). These connections are typically made from a PC or another Android device. However, there is also a way to establish an ADB connection from your own device. This method allows the device to communicate directly with itself using its internal network protocol via a localhost loopback connection.
The requested feature was proposed in response to the discovery of a vulnerability, 'CVE-2026-0073,' which allows for complete bypass of wireless ADB authentication. The request asks for developers to be able to specify which network interface the ADB server binds to. In response to this request, a Google employee replied, 'How about restricting it to only bind to the Wi-Fi interface, wlan0?'
The important point is that this will block connections via the localhost loopback address.
If this proposal is adopted, developers will no longer be able to use arbitrary network interfaces, which Kitsumed points out means that 'many other specialized development environments will become unavailable, such as ADB connections using only one device, ADB over VPN, and ADB over Ethernet.'
Kitsumed argued that while the vulnerability in question could potentially lead to privilege escalation if exploited, it cannot be executed by a malicious app alone and always requires multiple manual operations by a human. Therefore, he disagreed with restricting all options at once.
Related Posts:
in Software, Smartphone, Posted by log1p_kr