--- title: Android May Soon Restrict On-Device ADB, Affecting... description: A developer warns about a proposed Google change that could restrict on-device ADB (loopback) connections on Android, triggered by CVE-2026-0073. The change,... canonical: https://daily.dev/posts/android-may-soon-restrict-on-device-adb-affecting-shizuku-libadb-and-developers-c2ytcrxx7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Android May Soon Restrict On-Device ADB, Affecting Shizuku, libadb and Developers | daily.dev og:description: A developer warns about a proposed Google change that could restrict on-device ADB (loopback) connections on Android, triggered by CVE-2026-0073. The change,... og:url: https://daily.dev/posts/android-may-soon-restrict-on-device-adb-affecting-shizuku-libadb-and-developers-c2ytcrxx7 og:image: https://api.daily.dev/og/posts/c2yTCrXx7.png og:image:alt: Android May Soon Restrict On-Device ADB, Affecting Shizuku, libadb and Developers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Android May Soon Restrict On-Device ADB, Affecting Shizuku, libadb and Developers **[Hacker News](https://daily.dev/sources/hn)** · 10 min read · 2 upvotes · 0 comments ## Summary A developer warns about a proposed Google change that could restrict on-device ADB (loopback) connections on Android, triggered by CVE-2026-0073. The change, suggested by an ADB core maintainer, would limit ADBD to only the wlan0 interface, effectively breaking tools like Shizuku, libadb-android, App Manager, and many other open-source power-user apps. The author argues that on-device ADB exploitation requires multiple deliberate human actions and cannot be silently abused by malicious apps. The proposed solution is a persistent, user-controlled toggle rather than an outright ban, preserving legitimate developer and accessibility use cases while addressing the security concern. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 255 comments across hackernews (as of 2026-07-25). **TL;DR:** The community is largely skeptical and critical of Google's proposed change to restrict ADB loopback access, viewing it as a thinly veiled attempt to block tools like Shizuku/Canta rather than a genuine security fix, though some acknowledge the underlying CVE is real and legitimate. **Sentiment:** 5% positive · 25% mixed · 70% skeptical **The case for** - The actual CVE (auth bypass in ADB) is a genuine vulnerability that deserves to be fixed. - Restricting ADB to specific network interfaces (like an allowlist) would be a reasonable, targeted security improvement. - Residential proxy/botnet abuse of open ADB on cheap TV boxes is a real threat vector worth addressing. **The pushback** - Exploiting ADB requires multiple deliberate user steps (enabling developer mode, enabling wireless ADB, approving connections), making it an implausible attack vector for ordinary users. - Blocking loopback ADB would break legitimate tools like Shizuku and Canta that fill gaps left by Android's restrictive permission system. - Commenters widely suspect the real motive is to close sideloading and privilege-escalation avenues rather than protect users. - Google Play Services itself has unchecked privileged access while user-controlled tools are being locked down, which commenters call a double standard. - The change fits a broader pattern of Google incrementally restricting user control of their own devices under the guise of security. **By community** - hackernews (skeptical): Commenters are predominantly critical, arguing the security justification is pretextual and the real target is tools like Shizuku, while a minority defend the CVE fix as legitimate. **Hottest debate:** Whether blocking ADB over loopback is a genuine security fix or a pretext to eliminate developer/power-user tools like Shizuku and Canta. **Open questions** - Why not simply allow users to configure which interfaces ADB binds to, rather than removing loopback support entirely? - If Google Play Services retains full privileged device access, why should user-authorized ADB tools be restricted? - Will the EU or other regulators intervene to prevent further erosion of user control over Android devices? **Highlights** > It seems to require the user to: 1. Enable Developer Mode by going to an obscure settings page and tapping the build number seven times 2. Enable USB ADB debugging in the Developer Options 3. Establish an actual USB ADB session 4. Enable TCP/IP ADB debugging in the Developer Options 5. Unknowingly download a malware app from the official Play Store 6. Blindly click "Yes" on the permission prompt. In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. And it only works if the Play Store is useless at preventing malware in the first place - but I thought their excellent app scanning was the entire reasoning behind all-but-banning 3rd-party app stores and sideloading??? It is "for safety" in the same sense that governments banning all encryption is to "protect the children" or to "prevent terrorism": flawed justification invented to distract from the real reason they want it. > — [crote on hackernews · 1 comments](https://news.ycombinator.com/item?id=49046291) > Can you provide a reasonable definition where an authentication bypass in ADB doesn't qualify as a vulnerability? Is there a use case for allowing anyone on your network to run adb commands without your approval? There are 3 things which I feel like are being confused here: 1. There was a genuine authentication bypass vulnerability in ADB (bad) 2. Initial proposed change wants to add an option to limit the ADB server to certain IPs or network interfaces (good - it doesn't affect you) 3. Response to the original request, proposing that ADB shouldn't be allowed to listen on loopback interfaces (bad/nefarious - it breaks functionality) > — [dns\_snek on hackernews](https://news.ycombinator.com/item?id=49045930) > So why do Google Play Services, etc. have full privileged access to a phone, including private data and phone call audio, but the user doesn't? It is tech feudalism - you don't own anything anymore, you just get to live on the digital land of a bunch of ~trillion dollar companies. At least, that is the goal. IMO either everyone gets access at the user's discretion or Google has to sandbox their own GMS services as well. > — [microtonal on hackernews](https://news.ycombinator.com/item?id=49046230) > What I find most annoying aspect of all software from 2010s onwards is this stupid discourse and associated results: - some people want A, or A might even be already in use - A is problematic for $MODERATE_OR_MILD_REASON - B is introduced and made default - a config switch between A and B is never considered So, so tiring. If I want to bind ADB to localhost, _let me_. It's my device and my problem, ffs. > — [3form on hackernews · 4 comments](https://news.ycombinator.com/item?id=49045379) > > This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. Not just that. A non-development Android build will also prompt the user when a connection is made to authorize the client's key. This once again isn't about security of users, this is about security of the company's interests. > — [m132 on hackernews](https://news.ycombinator.com/item?id=49046124) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49045159) · 184 points · 255 comments ## Similar posts on daily.dev - [Your phone can run ADB on itself with no PC, and it's how I finally killed the bloatware I couldn't uninstall](https://daily.dev/posts/your-phone-can-run-adb-on-itself-with-no-pc-and-it-s-how-i-finally-killed-the-bloatware-i-couldn-t--yjswd4v3f) · XDA Developers · 0 upvotes · 0 comments - [This Week In Security: Android Exposes ADB, ShinyHunters Get Paid, Robot Dogs, And More](https://daily.dev/posts/this-week-in-security-android-exposes-adb-shinyhunters-get-paid-robot-dogs-and-more-nxdkbbxku) · Hackaday · 0 upvotes · 0 comments - [What \`adb\` Can Teach You About Broken Android IPC Protections](https://daily.dev/posts/what-adb-can-teach-you-about-broken-android-ipc-protections-z4o7dlwb2) · Medium · 3 upvotes · 0 comments - [Backup Vulnerabilities Android Mobile Application](https://daily.dev/posts/backup-vulnerabilities-android-mobile-application-hqyusgtzh) · InfoSec Write-ups · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mobile](https://daily.dev/tags/mobile), [#android](https://daily.dev/tags/android), [#android-development](https://daily.dev/tags/android-development) [View this post on daily.dev](https://daily.dev/posts/android-may-soon-restrict-on-device-adb-affecting-shizuku-libadb-and-developers-c2ytcrxx7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Android May Soon Restrict On-Device ADB, Affecting Shizuku, libadb and Developers","url":"https://daily.dev/posts/android-may-soon-restrict-on-device-adb-affecting-shizuku-libadb-and-developers-c2ytcrxx7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/android-may-soon-restrict-on-device-adb-affecting-shizuku-libadb-and-developers-c2ytcrxx7"},"datePublished":"2026-07-25T08:03:32.834Z","dateModified":"2026-07-25T12:15:56.478Z","description":"A developer warns about a proposed Google change that could restrict on-device ADB (loopback) connections on Android, triggered by CVE-2026-0073. The change,...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/android-may-soon-restrict-on-device-adb-affecting-shizuku-libadb-and-developers-c2ytcrxx7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,mobile,android,android-development","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Android May Soon Restrict On-Device ADB, Affecting Shizuku, libadb and Developers"}]} ```