Executive Summary

The vulnerability exists in Home Assistant's LocationSensorManager BroadcastReceiver, which was exported without any permission restrictions prior to version 2026.5.3.

This means that any installed app on the device, even one without any runtime permissions, can send a forged Google Play Services LocationResult broadcast directly to the receiver.

The receiver trusts this broadcasted location data and forwards it to the user's Home Assistant server as if it were the device's real location.

This bypasses Android's developer-mode 'Mock Location' protections and allows a local malicious app to fake the user's GPS position.

As a result, the attacker can manipulate zone-based automations such as unlocking doors, disarming alarms, or opening garages by spoofing the device location.

The issue was fixed in Home Assistant version 2026.5.3 by restricting the export of the LocationSensorManager.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local malicious app on your device to spoof your GPS location without needing any permissions.

By faking your location, the attacker can trigger zone-based automations in Home Assistant that rely on your real location.

• Unlocking doors
• Disarming alarms
• Opening garage doors

This can lead to unauthorized physical access to your home or property and compromise your security.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the LocationSensorManager BroadcastReceiver being exported without permission, allowing local apps to send forged location broadcasts. Detection would involve checking if the vulnerable version of Home Assistant (prior to 2026.5.3) is installed and if the LocationSensorManager BroadcastReceiver is exported without restrictions.

To detect exploitation attempts, you can monitor for suspicious broadcasts of the ACTION_LOCATION_RESULT or similar intents being sent to the LocationSensorManager. On an Android device, you might use commands such as:

• adb shell dumpsys package home_assistant | grep LocationSensorManager
• adb shell pm list receivers -a | grep LocationSensorManager
• adb logcat | grep LocationSensorManager

These commands help verify if the receiver is exported and monitor logs for suspicious location broadcasts. However, no specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update Home Assistant to version 2026.5.3 or later, where the vulnerability is fixed by restricting the export of the LocationSensorManager BroadcastReceiver.

If updating immediately is not possible, consider limiting the installation of untrusted local apps on the device, as the vulnerability requires a local app to send forged broadcasts.

Additionally, monitoring and restricting broadcast intents related to location updates can help reduce risk until the update is applied.

Useful 0 Not Useful 0