Executive brief
Android's ranging service contains a flaw that allows attackers to intercept communications without proper authorization checks. An attacker on the network could capture sensitive information transmitted by the ranging service without needing elevated privileges or user interaction, compromising the confidentiality of device location and ranging data.
Technical details
The vulnerability exists in multiple functions of RangingServiceImpl.java where permission validation is missing before processing ranging requests. This permits unauthenticated or unauthorized network-based attackers to perform a man-in-the-middle (MITM) attack and intercept or disclose sensitive ranging and proximity information. The issue affects Android devices via a network attack vector with no additional execution privileges or user interaction required. Patches addressing this vulnerability have been released in Android security patch level 2026-09-05 and later, with source code fixes available in AOSP versions 14 through 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched