Google Proposes Blocking Local ADB Connections, Threatening Open-Source Android Ecosystem

A Google employee has proposed a significant change to the Android Debug Bridge (ADB) protocol that would restrict connections exclusively to the Wi-Fi interface, effectively blocking local loopback connections. The proposal, discussed on Google IssueTracker in response to security vulnerability CVE-2026-0073, aims to prevent privilege escalation exploits but has drawn sharp criticism from developers. The change threatens to disrupt open-source tools and power-user applications, such as Shizuku and libadb-android, which rely on local loopback connections for legitimate developer and accessibility use cases.

The proposal suggests binding the ADB server daemon (ADBD) exclusively to the wlan0 interface to reduce exposure to bad actors who might use loopback connections for privilege escalation. This discussion follows the identification of CVE-2026-0073, a security vulnerability that previously allowed the Wireless ADB authentication process to be fully bypassed. While the feature request aims to let developers choose which interface ADBD listens to, a core maintainer’s comment indicated a preference for restricting connections to Wi-Fi only, a stance that has alarmed the open-source community.

Developer Kitsumed, creator of the Shizuku-based app ShizuCallRecorder, has published a blog post highlighting the potential negative impact on open-source power-user apps, accessibility tools, and developer setups. Kitsumed argues that while loopback ADB can be exploited, it requires manual user intervention, such as enabling USB debugging or TCP/IP, and cannot be initiated by a malicious app alone. The developer contends that the risk ratio justifies maintaining the functionality for legitimate users who rely on these tools for daily operations.

The change threatens to disrupt an ecosystem of applications that emerged from niche developer practices. Originally designed for USB connections between a device and a separate machine, On-Device ADB allows developers to run an ADB client directly on the phone via terminal emulators like Termux. This practice has enabled projects such as Shizuku by RikkaApps and libadb-android by MuntashirAkon, which provide essential functionality for privacy, accessibility, and advanced device management.

Kitsumed proposes that users should be able to disable this restriction via a persistent toggle that survives reboots, rather than a permanent block. The author notes that the core ADB maintainer involved in the discussion has recently been assigned to other tasks, adding uncertainty to the timeline of the change. The proposal remains a feature request and not an official Google announcement, but the community is urging technical users to provide feedback on the IssueTracker thread to prevent the loss of critical functionality.