Executive brief
Wear OS contains a vulnerability in its permission-checking mechanism that allows unauthorized apps to access sensitive device state information (such as network status, sensor readings, or system state) without proper authorization. An attacker with a malicious app could monitor private device behavior without needing elevated privileges or user interaction, potentially exposing patterns of device use to third parties.
Technical details
The vulnerability exists in the checkReadPermission method of PermissionsManager.java in the Wear OS Framework component, where a permission check is missing when accessing sensitive device state data. This allows a local attacker to read protected information without the required permissions. The attack requires no additional execution privileges and needs no user interaction for exploitation. The vulnerability affects Wear OS on Android 14, 16, and 17; patches are available via the September 2026 security update (patch level 2026-09-01 or later).
Affected products
- Google Wear OS 14, 16, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-01: patched