Home Assistant core versions before 2026.5.3 contain an improper export of the LocationSensorManager BroadcastReceiver component on Android. This component is exported with no permission requirement, allowing any installed app, even without runtime permissions, to broadcast a forged Google Play Services LocationResult. The receiver trusts this data and forwards it to the Home Assistant server as the device's real location. This vulnerability circumvents Android's developer-mode mock location restrictions and can be exploited by a local malicious app to manipulate location-based automations such as unlocking doors or disarming alarms. The vulnerability is addressed and fixed in Home Assistant core version 2026.5.3.

An attacker with a local malicious app installed on the user's Android device can spoof GPS location data to the Home Assistant core, causing it to believe the device is at a different location. This can lead to unauthorized triggering of zone-based automations, such as unlocking doors, disarming alarms, or opening garages, without the user's consent. The confidentiality of location data is not impacted, but the integrity of location-based controls is compromised. There is no impact on availability. No known exploits in the wild have been reported.

This vulnerability is fixed in Home Assistant core version 2026.5.3. Users and administrators should upgrade to version 2026.5.3 or later to remediate this issue. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on applying the official fix.