Google Considers Restricting Android's Internal ADB Debugging

Google engineers are evaluating changes to the Android Debug Bridge (ADB) daemon that would limit its operation to external network interfaces such as Wi‑Fi or USB and discontinue the current binding to the localhost (127.0.0.1) address. The proposal aims to improve security after the discovery of the critical CVE‑2026‑0073 vulnerability, which allowed attackers on the same Wi‑Fi network to bypass wireless ADB authentication.

If implemented, the change would affect applications that rely on the loopback ADB connection to obtain shell privileges without root access, most notably the Shizuku app and other similar tools used by power users, developers, and IT administrators. The modification is still under discussion and has not been confirmed for an upcoming Android release.