Sanctioned billion-dollar cybersecurity company from Russia finds 11 vulnerabilities in Google and Apple products — including a nasty one that compromised a device just through a malicious NFC tag
Positive Technologies, a Russian cybersecurity firm under U.S. sanctions, disclosed 11 security flaws across Android and Apple platforms, highlighting how even heavily vetted ecosystems can harbor critical weaknesses that ordinary users may never see coming.
Android NFC Tag Exploit Enables Silent App Execution
The first Android vulnerability lets a maliciously programmed NFC tag automatically fetch, install, and launch an app on a nearby device without any user interaction. This “zero‑touch” vector exploits the default behavior of NFC readers that trust proximity as implicit consent. Because the attack requires only physical proximity, any public space with NFC‑enabled terminals becomes a potential launchpad for malware.
Google addressed the flaw in its September 2026 patches, meaning devices that have applied the update are no longer vulnerable. However, the advisory did not specify which Android versions or Pixel models were affected, leaving the true exposure window ambiguous. Users who delay updates remain at risk from a threat that can be triggered by simply placing a phone near a rogue tag.
From a defensive standpoint, the NFC exploit underscores a broader design tension: convenience features like tap‑to‑connect often assume benign intent, yet they open a backdoor for attackers who can embed malicious payloads in everyday objects.
Android Wi‑Fi Configuration Bypass Grants Network Control
The second Android flaw permits an already installed app to modify Wi‑Fi settings, join arbitrary networks, install certificates, and adjust proxy parameters without requesting additional permissions. This capability bypasses the standard permission model that normally forces user approval for network changes. As a result, a compromised app can silently redirect traffic through attacker‑controlled servers.
Both vulnerabilities were rated as high severity, reflecting the potential for data exfiltration, credential theft, and lateral movement within corporate networks. Because the exploit does not rely on user interaction, it can be chained with other malware to establish persistent footholds. The lack of explicit permission prompts removes a critical layer of user awareness.
Google’s patch rollout in September 2026 mitigates the issue, but the advisory’s silence on affected device counts means many users may still be unaware of their exposure. Enterprises should therefore audit device compliance and enforce rapid patch deployment to close the gap.
Apple macOS Privilege Escalation and Data Exposure Flaws
Positive Technologies reported nine distinct Apple flaws, several of which grant apps elevated privileges that rival those of the operating system itself. One macOS vulnerability enables a hostile application to obtain the highest system privileges, effectively bypassing sandbox protections and gaining unrestricted control over the machine. Another flaw allows deletion of access keys without user consent, eroding the integrity of cryptographic safeguards.
Additional issues include kernel‑level weaknesses that could destabilize the device or expose protected information, though the source truncates details on the exact impact. Collectively, these flaws compromise the privacy model Apple promotes, turning trusted software into a conduit for data leakage. The high severity rating signals that exploitation could lead to full system compromise.
Apple has not yet disclosed remediation timelines, leaving users to rely on future updates. In the interim, the presence of such deep‑rooted vulnerabilities challenges the assumption that macOS offers superior security by default.
What This Actually Means For You
- Ensure your Android device has installed the September 2026 security update; without it, NFC‑based attacks remain viable.
- Audit installed apps for unnecessary network permissions and revoke any that can alter Wi‑Fi settings without justification.
- On macOS, monitor for unexpected privilege escalations by checking system logs for processes running with root‑level access.
- Adopt a rapid patch management policy for all devices, recognizing that delayed updates keep you in the attack surface.
- Consider using NFC‑blocking accessories or disabling NFC when not needed to eliminate the physical trigger vector.
Immediate Action Steps
First, verify your Android OS version and apply the latest security patch released in September 2026. On most devices, this can be done via Settings → System → Advanced → System update; confirm the patch level includes the NFC and Wi‑Fi fixes.
Second, review each installed Android app’s permission set, focusing on network‑related privileges, and disable or uninstall any that request more access than their functionality requires. On macOS, run the Console app to search for processes with elevated privileges and report anomalies to Apple support.
Frequently Asked Questions
Can a malicious NFC tag infect my phone without me touching it?
Yes, the disclosed Android flaw allows a crafted NFC tag to automatically fetch, install, and launch an app when a phone is merely placed near the tag, bypassing any user approval.
Do the Android Wi‑Fi changes require any special permissions?
No, the vulnerability lets an app alter network settings, add certificates, and modify proxy parameters without requesting extra permissions or prompting the user.
Has Apple released patches for the macOS privilege escalation bugs?
Apple has not announced specific remediation dates; users must await future updates while monitoring for any security