CVE-2026-54318

nvd.nist.gov • June 24, 2026

This CVE record is currently being enriched by team members, this process results in the association of reference link tags, CVSS, CWE, and CPE applicability statement data

Assistant is open source automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services LocationResult directly to it; the receiver trusts the extra and forwards it to the user's Assistant server as the device's real location. This bypasses Android's developer-mode "Mock Location" gate and allows a local malicious app to drive zone-based automations (unlock door / disarm alarm / open garage) by faking the user's GPS position. This vulnerability is fixed in 2026.5.3.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk Vulnerabilities in Home Assistant Exposed On June 23, 2026, two critical vulnerabilities were disclosed in Home Assistant, an open-source automation platform. CVE-2026-54317 allows unauthorized access to alarm panel status and device topology via a misconfigured API endpoint. CVE-2026-54318 enables local malicious apps to spoof GPS locations, potentially triggering unauthorized automations like unlocking doors. Both vulnerabilities were addressed in the latest updates: Assistant OS version 18 and Assistant Companion version 2026.5.3. Users are urged to update their systems immediately to mitigate risks. The vulnerabilities were rated high risk, with CVSS scores of 7.6 and 7.1, respectively. The issues affect all versions prior to the updates, emphasizing the need for prompt action. 1 sources 72

Extracted Entities

CVE-2026-54318

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)