CVE-2026-107153

Multiple smartphones provided by Rakuten Mobile, Inc.

Published Oct 14, 2026 · updated Oct 14, 2026 · JVN

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Oct 14, 2026 · NIST NVD
Detected
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
Oct 14, 2026 · NIST NVD
Updated
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.

Sources

CVE.orgVulnerability recordCVE-2026-107153
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-107153
30-day exploitation probability 0.2%
first.org
JVNGovernment advisoryCVE-2026-107153
JVN#47427200: Multiple Rakuten Mobile smartphones shipped with a known private test key for Android Verified Boot
jvn.jp
NIST NVDVulnerability recordCVE-2026-107153
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
nvd.nist.gov