CVE-2026-107153 Rakuten Mobile, Inc. CVE debrief

Who should care

Defenders and security teams for Rakuten Mobile smartphone users, particularly those with physical access to devices, should assess exposure and verify AVB configurations. Security teams should also monitor for suspicious activity indicating potential exploitation and assess physical access controls to prevent unauthorized device access. Additionally, operators and platform administrators should review the vulnerability and its impact on their systems.

Why it matters

CVE-2026-107153 allows installation of crafted system images on Rakuten Mobile smartphones with physical access, potentially bypassing security mechanisms. Defenders should verify device exposure, assess AVB configurations, and monitor for suspicious activity.

• Verify AVB configuration to prevent crafted system image installation
• Monitor for suspicious activity indicating potential exploitation
• Assess physical access controls to prevent unauthorized device access

Technical summary

Rakuten Mobile smartphones, including Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten BIGs, use AOSP test keys for Android Verified Boot (AVB). This allows installation of crafted system images with physical access, potentially bypassing security mechanisms. The vulnerability impacts device security and defenders should verify device exposure, assess AVB configuration, and monitor for suspicious activity. The affected products are Rakuten Mobile smartphones with AOSP test keys for AVB functionality. The vulnerability class is related to the use of test keys in AVB.

Defensive priority

Verify device exposure, assess AVB configuration, and monitor for suspicious activity

Recommended defensive actions

• Verify device exposure and AVB configuration
• Monitor for suspicious activity
• Assess physical access controls
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

Official CVE Program and NVD records confirm AOSP test key usage in Rakuten Mobile smartphones. Physical access allows crafted system image installation. The evidence is based on CVE Program and NVD records, which provide details on the vulnerability and its impact. The records indicate that the vulnerability is due to the use of AOSP test keys for Android Verified Boot (AVB) in multiple Rakuten Mobile smartphones.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.