Google正考虑对Android设备上的本地ADB连接进行限制，以防范恶意应用程序通过本地回环地址实施权限提升攻击[1]。这一提议源于CVE-2026-0073安全漏洞，该漏洞允许绕过Wireless ADB的认证流程[1]。
根据Google IssueTracker上的功能请求，一位ADB核心维护者建议仅允许ADBD绑定到WiFi接口(wlan0)[1]。本地On-Device ADB是指开发者在同一设备上运行ADB客户端和服务器，通过本地回环地址(127.0.0.1)连接的调试方式[1]。
然而，开发者社区对此举表示担忧，认为这将破坏合法的开发工作流程和开源生态[1]。受影响的项目包括Shizuku、libadb-android、App Manager和aShell等依赖本地ADB功能的工具[1]。对于某些用户而言，这类工具对于特定需求至关重要——报告此事的Shizuku相关开发者因残障需求而依赖该技术[1]。
Google is considering limiting on-device ADB connections on Android devices to prevent malicious applications from exploiting local loopback addresses to escalate privileges [1]. The proposal stems from a feature request on Google's IssueTracker and is rooted in CVE-2026-0073, a security vulnerability in which wireless ADB authentication could be circumvented [1].
An ADB core maintainer has suggested restricting ADBD to bind exclusively to the WiFi interface (wlan0) [1]. On-device ADB refers to developers running both an ADB client and server on the same device, connecting through a local loopback address (127.0.0.1) [1].
The proposed restriction has raised concerns among developers about potential disruption to legitimate development workflows and open-source ecosystems [1]. Several projects rely on on-device ADB functionality, including Shizuku, libadb-android, App Manager, and aShell [1]. Some developers have emphasized that such tools serve accessibility needs; for example, one article author who is a ShizuCallRecorder developer noted dependency on the feature due to disability-related requirements [1].
It should be noted that this remains a proposal under consideration and is not yet an official announcement from Google [1].