Executive brief
A logic error in Android's Bluetooth security module allows attackers to downgrade encryption, potentially exposing sensitive wireless communication data. The vulnerability requires no special privileges or user interaction and can be exploited remotely, affecting any Android device relying on Bluetooth connectivity for sensitive operations.
Technical details
A logic error in the btm_sec_encrypt_change function within btm_sec.cc (part of Android's Bluetooth stack) permits a downgrade attack on Bluetooth encryption negotiation. The vulnerability allows an attacker to downgrade the encryption level during the Bluetooth pairing or re-encryption handshake. The attack is remotely exploitable via Bluetooth without requiring authentication or user interaction, though the attacker must be in Bluetooth range. The primary impact is information disclosure of unencrypted or weakly encrypted Bluetooth traffic. Patches are available in Android AOSP versions 14, 15, 16, 16-qpr2, and 17 as part of the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: CVE-2026-28627 published in Android Security Bulletin
- 2026-09-05: patched: Security patch level addressing the vulnerability