Executive brief
A vulnerability in Android's Bluetooth adapter service allows attackers to bypass the device pairing process and escalate privileges remotely without user consent. This could enable unauthorized access to a device's Bluetooth functionality and potentially lead to complete system compromise, as an attacker could gain elevated permissions normally requiring explicit user approval.
Technical details
A logic error in the handleBondStateChanged method of AdapterService.java allows attackers to bypass Bluetooth device pairing validation. The vulnerability is a privilege escalation (EoP) issue triggered by manipulated Bluetooth bonding state transitions, requiring no user interaction or additional execution privileges. An attacker with network access can exploit this to escalate privileges remotely on affected Android devices. Patches are available in AOSP versions 14, 15, 16, 16-qpr2, and 17 as of the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17 (patched in 2026-09-05 security patch level)
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched