On October 14, 2026, JVN (Japan Vulnerability Notes, a vulnerability information database) published a vulnerability affecting several Rakuten Mobile smartphones.
The affected models are Rakuten Mini, Rakuten Hand, Rakuten Hand 5G and Rakuten BIG s. In every case, all versions are affected.
A disclosure first. I am an employee of Rakuten Group. However, this article is based only on the JVN announcement, Rakuten Mobile’s official support pages, and the report by Keitai Watch. I have not used any internal information. This is my personal view.
Bottom line
- The key used by the mechanism that checks at startup that the software is genuine (Android Verified Boot) was a “test key” that anyone can obtain, used as it was
- The condition for abuse is physical access to the device. I could not confirm any statement that it can be attacked remotely
- The affected products have already reached end of support. No plan to release a fix is written
- The official guidance is: “stop using them and use another product”
In other words, this is not a case of “someone can take over your phone remotely right now.” On the other hand, continuing to use a device that will not be fixed is not recommended.
What has been published
The sources are JVN#47427200 (published October 14, 2026) and the Rakuten Mobile support pages for each model.
What the problem is
- The device has a mechanism that checks at startup whether the software has been tampered with
- The key used for that check was still the test key distributed by the Android developer (AOSP)
- Because the key is public, there is a risk that tampered software will be treated as genuine
What impact is possible
- An attacker who can operate the device temporarily could install tampered software
- As a result, gaining control of the device, running malicious programs, and changing settings could occur
Rating (JVN)
- CVE number: CVE-2026-107153
- CVSS v4.0: 7.0
- CVSS v3.0: 6.6
- The condition required for an attack is, according to the vector notation, physical access
Affected models
- Rakuten Mini
- Rakuten Hand
- Rakuten Hand 5G
- Rakuten BIG s
Rakuten Mobile’s guidance
The Rakuten Mini support page says the following.
- The vulnerability was identified as of September 28, 2026
- Continued use of the affected products is not advised; it recommends using another product
- The reason is that support ended on November 28, 2023
- Repair acceptance also ended on the same date
- I could not find a contact desk dedicated to this vulnerability (only a link to the general Communication Center for products)
JVN also says “end of support” for the other 3 models. However, as far as I could confirm, I could find an end date only for the Rakuten Mini.
What is not written
This is probably what owners are most concerned about.
- Whether there is any compensation, trade-in, or discount for replacing the device
- Any plan to provide a fix (it reads as a policy of not releasing one, but this is not stated explicitly)
- Any interim measures until you stop using the device
- Whether it can be attacked remotely (there is only the statement that physical access is the condition)
- Whether there have been any actual cases of abuse
- The end-of-support dates for Rakuten Hand, Hand 5G and BIG s
Also, as of the Keitai Watch article, I could not find a separate notice about this matter on Rakuten Mobile’s “News” page. The guidance is on the support page for each model.
General precautions for owners
The following is general advice, not an official instruction.
Since the condition for abuse is “physically touching the device,” what you should think about is situations where the device ends up in someone else’s hands.
- Loss or theft is the biggest risk. Always set a screen lock, and do not leave the device with other people
- Do not keep using it with important things on it, such as banking apps, payment apps, and work data. Limit it to a backup phone, or to calls and notes only
- Consider replacing it. Devices past end of support also become less likely to receive OS and app updates
- Factory reset it when you let it go. When you sell or give away a used device, erase the data first. Follow the seller’s instructions on how the device is handled
- If you are given a device by someone, or buy a used one, check whether the support period remains before you buy
The “switch” here means replacing the device. It does not mean switching mobile carriers.
What to do if you lose your device is summarized in the first steps when you lose your phone. Preparing for a phone upgrade is in the phone upgrade checklist. For contact points, see the article on support contacts.
There was another announcement the same week
On October 13, 2026, there was a separate announcement that payment certificates in “my Rakuten Mobile” might be viewable by third parties. This is a separate matter from the device issue here. Please do not confuse them. I have written about it in detail in another article.
Summary
- A known test key was used for boot verification on all versions of Rakuten Mini, Hand, Hand 5G and BIG s (JVN#47427200, published October 14, 2026)
- Abuse requires physically touching the device. I could not confirm any statement about remote attacks
- The affected products have reached end of support, and no plan for a fix is written. The official guidance recommends stopping use and switching to another product
- Compensation, trade-in, interim measures, and the end-of-support dates (other than for the Mini) are not written, as far as I could confirm
- If you own one: set a screen lock in case of loss or theft, do not put important apps on it, and consider replacing it
Content may be updated. Check the latest information on JVN and on Rakuten Mobile’s support page for each model. The content of this article is as of October 15, 2026.
Sources:
- JVN#47427200 “Known test keys are used as-is in the Android Verified Boot feature of multiple Rakuten Mobile smartphones” (October 14, 2026) https://jvn.jp/jp/JVN47427200/index.html
- Rakuten Mobile Rakuten Mini support information https://network.mobile.rakuten.co.jp/product/smartphone/rakuten-mini/support/index.html
- Keitai Watch “Vulnerability in Rakuten Mobile’s ‘Rakuten Mini’, ‘Rakuten Hand’ and others: test key remains in the AVB feature; users advised to stop use and switch” (October 14, 2026) https://k-tai.watch.impress.co.jp/docs/news/2148168.html
This article contains affiliate advertising. If you apply for a product or service through links on this site, we may receive compensation from partner companies. Additionally, the operator is an employee of Rakuten Group and may receive compensation through an employee referral program. Article content and evaluations are based on the operator's actual experience and research, regardless of advertising. For details, see the Disclaimer & Affiliate Disclosure. Disclaimer & Affiliate Disclosure
This article contains machine translation. For official terms, please refer to the multilingual pages on the official Rakuten Mobile website.
If you have concerns about Rakuten Mobile's coverage area or signal conditions, you can inquire through the official signal improvement survey request form .
