Executive brief
Android's Bluetooth ranging capabilities component can inadvertently expose a device's Bluetooth MAC address to local applications due to a missing permission check in the data serialization code. An attacker with local access could retrieve the device's Bluetooth MAC address without special privileges, which could be used for device fingerprinting, tracking, or other privacy violations.
Technical details
The vulnerability exists in the writeToParcel method of BleRssiRangingCapabilities.java, where sensitive Bluetooth MAC address data is serialized without proper permission validation. An unprivileged local process can trigger this method to extract the MAC address from the parcel data. The attack requires no additional execution privileges, user interaction, or network access—only local presence on the device. The vulnerability leads to information disclosure of sensitive identifiers used for Bluetooth device identification. Patches are available in Android 14, 15, 16 (including 16-qpr2), and 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later