CVE-2026-107153 in Rakuten Mini
Summary
by MITRE • 10/14/2026
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in certain smartphone devices distributed by Rakuten Mobile, Inc., stems from the improper configuration of the Android Verified Boot AVB mechanism during the manufacturing or provisioning phase. Specifically, these devices are utilizing AOSP test keys rather than production-signed cryptographic keys for their boot chain verification. In a standard secure deployment scenario, the bootloader and subsequent system partitions must be signed with private keys that correspond to public keys hardcoded into the device's hardware-backed keystore or root of trust. This ensures that only authorized, unmodified software provided by the manufacturer can execute on the device. By employing test keys, which are widely known and publicly documented within the Android Open Source Project ecosystem, the cryptographic integrity check is effectively neutralized for any attacker possessing physical access to the target hardware.
From a technical perspective, this misconfiguration represents a critical failure in the implementation of secure boot principles. The AVB system relies on a chain of trust that begins at the bootloader and extends through the kernel, ramdisk, and system partitions. When test keys are used, an adversary can construct a malicious or modified Android image using these known private keys to generate valid digital signatures. Because the device's hardware trusts the corresponding public key embedded in its firmware, it will accept this crafted image as legitimate without raising any integrity violations. This bypasses essential security controls designed to prevent unauthorized code execution and ensures that the operating system remains in a trusted state. The flaw is not inherent to the Android framework itself but rather results from an oversight or convenience-driven decision during device customization where development artifacts were inadvertently shipped with consumer hardware.
The operational impact of this vulnerability is severe, particularly for enterprise users or individuals prioritizing data privacy and security. With physical access to the affected smartphone, a threat actor can flash a custom recovery image such as TWRP or directly install a modified system partition containing malware, spyware, or backdoors. This allows for complete compromise of the device's confidentiality and integrity. Attackers could exfiltrate sensitive personal data, intercept communications, monitor user activity through hidden keyloggers or camera access, or establish persistent remote control capabilities that survive factory resets if they also modify the recovery partition. Furthermore, this weakness undermines any security features dependent on a verified boot state, such as Samsung Knox or other hardware-backed isolation environments, rendering them ineffective against locally initiated attacks.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-345 Insufficient Verification of Data Authenticity within the context of secure boot implementations. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter via malicious firmware flashing, as well as T1608 Install Malicious Firmware which describes the act of replacing legitimate system images with compromised ones. To mitigate this risk, Rakuten Mobile must immediately issue a security patch that reconfigures the AVB keys to use production-grade certificates signed by their private master key. Devices already in circulation require an over-the-air update or manual flashing procedure using official tools provided by the manufacturer to replace the vulnerable boot images with securely signed versions. Until such remediation is applied, users should avoid connecting these devices to untrusted computers and consider restricting physical access strictly to authorized personnel only.