Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-54318

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services LocationResult directly to it; the receiver trusts the extra and forwards it to the user's Home Assistant server as the device's real location. This bypasses Android's developer-mode "Mock Location" gate and allow
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f017814b64c904df44ebb5d3e0c73e1477b56104135f0b5c34e83b835f3cbb6e
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"core","vendor":"home-assistant","versions":[{"status":"affected","version":"< 2026.5.3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:81d1981a2e016f56fff7168797bc99cabf8cbe81fe45f4ffe76aef98fba74978 · sha256:8b068ceca261d4ee… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:81d1981a2e016f56fff7168797bc99cabf8cbe81fe45f4ffe76aef98fba74978 · sha256:8b068ceca261d4ee… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-926","description":"CWE-926: Improper Export of Android Application Components","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:81d1981a2e016f56fff7168797bc99cabf8cbe81fe45f4ffe76aef98fba74978 · sha256:8b068ceca261d4ee… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/home-assistant/android/pull/6837","tags":["x_refsource_MISC"],"url":"https://github.com/home-assistant/android/pull/6837"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:81d1981a2e016f56fff7168797bc99cabf8cbe81fe45f4ffe76aef98fba74978 · sha256:8b068ceca261d4ee… · /containers/cna/references/1
{"tags":["exploit"],"url":"https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:81d1981a2e016f56fff7168797bc99cabf8cbe81fe45f4ffe76aef98fba74978 · sha256:8b068ceca261d4ee… · /containers/adp/0/references/0
{"name":"https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3","tags":["x_refsource_CONFIRM"],"url":"https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:81d1981a2e016f56fff7168797bc99cabf8cbe81fe45f4ffe76aef98fba74978 · sha256:8b068ceca261d4ee… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer