{"id":"ASB-A-380091558", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-18T15:04:46.258745422Z", "aliases":["CVE-2026-0045", "A-380091558"], "details":"In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/dc64fbcebd089d82075ca5c26144ba3933189198", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cce3201a64ebe5806fa0842ea0475ee68ed8910", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b779276319f462e9a1f61e97375d78c219188813"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"155286932709982901211941271820606969643", "length":2536}, "id":"ASB-A-380091558-186b8869", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cce3201a64ebe5806fa0842ea0475ee68ed8910", "target":{"file":"system/bta/jv/bta_jv_act.cc", "function":"bta_jv_rfcomm_connect"}}, {"deprecated":false, "digest":{"line_hashes":["163089759142127586588324651590170982536", "185362144492042389778852082534923951970", "299146049654932286679684252146538042477", "245884674148920163474875848464493141963", "136040404144856022676109285507470382523", "268118490558179745562183388433856193629"], "threshold":0.9}, "id":"ASB-A-380091558-48ac0e80", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cce3201a64ebe5806fa0842ea0475ee68ed8910", "target":{"file":"system/bta/jv/bta_jv_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"204053646215637187823523884420175504269", "length":2703}, "id":"ASB-A-380091558-8bb3d7c0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b779276319f462e9a1f61e97375d78c219188813", "target":{"file":"system/bta/jv/bta_jv_act.cc", "function":"bta_jv_rfcomm_connect"}}, {"deprecated":false, "digest":{"line_hashes":["36467356241797826191898883367551871260", "56136246635340542338900908325101208086", "161240907973227795362103879973783025578", "147497994970655261063710976720259643055", "75711844978771333906290175064275198363"], "threshold":0.9}, "id":"ASB-A-380091558-a4061015", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cce3201a64ebe5806fa0842ea0475ee68ed8910", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"101682431887460014955467766976799533419", "length":1174}, "id":"ASB-A-380091558-aea61c86", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b779276319f462e9a1f61e97375d78c219188813", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"security_upgrade_possible"}}, {"deprecated":false, "digest":{"line_hashes":["90471395965423210681952246547087295692", "27781841517194712170158012037962339692", "35057174028523569150016769575442611538", "56041625589179657681109765112930699790"], "threshold":0.9}, "id":"ASB-A-380091558-af6208a6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b779276319f462e9a1f61e97375d78c219188813", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"274122828002331870840220504248638420514", "length":687}, "id":"ASB-A-380091558-af711ec1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/dc64fbcebd089d82075ca5c26144ba3933189198", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_is_upgrade_possible"}}, {"deprecated":false, "digest":{"function_hash":"305930527144224377311387077425957054761", "length":899}, "id":"ASB-A-380091558-d1fc6bfc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3cce3201a64ebe5806fa0842ea0475ee68ed8910", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_is_upgrade_possible"}}, {"deprecated":false, "digest":{"line_hashes":["120407114186603007367964648596233065001", "295577149032350445791988965255135284322", "254243829210005822855742074596367004964", "137214708186747992469385985530262358601"], "threshold":0.9}, "id":"ASB-A-380091558-e95c3352", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/dc64fbcebd089d82075ca5c26144ba3933189198", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"line_hashes":["46606172614049027696061413510971695463", "272121945295733399691280914139180258751", "222111781212807861444150640071854510049", "176747255395535273579322723197938636552", "36260336491784744904286958358995918941", "110450424347802099704304950361096992239", "4307573920395523246659933960998931260", "158627482189286232155870192643481704641"], "threshold":0.9}, "id":"ASB-A-380091558-f67789ef", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b779276319f462e9a1f61e97375d78c219188813", "target":{"file":"system/bta/jv/bta_jv_act.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/48eb145c9c8a94f863070804175fbf6fb355f8a1"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"274122828002331870840220504248638420514", "length":687}, "id":"ASB-A-380091558-3bccfd8f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/48eb145c9c8a94f863070804175fbf6fb355f8a1", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_is_upgrade_possible"}}, {"deprecated":false, "digest":{"function_hash":"246045453329049868580318585678768559258", "length":2061}, "id":"ASB-A-380091558-67b8eb8b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/48eb145c9c8a94f863070804175fbf6fb355f8a1", "target":{"file":"system/bta/jv/bta_jv_act.cc", "function":"bta_jv_rfcomm_connect"}}, {"deprecated":false, "digest":{"line_hashes":["176913036312087856290174883664458960371", "113340985784923630287529885877617535971", "202448637744410902751492056312456746846", "275534395085438161233861307059525226785", "36260336491784744904286958358995918941", "23877576667889797770546918605184706865", "281051978401748001198361444312995006964", "190840697624440987151310311024691265897"], "threshold":0.9}, "id":"ASB-A-380091558-923af5e8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/48eb145c9c8a94f863070804175fbf6fb355f8a1", "target":{"file":"system/bta/jv/bta_jv_act.cc"}}, {"deprecated":false, "digest":{"line_hashes":["233362710700459780504517130873991310009", "295577149032350445791988965255135284322", "193844408726808641575351268183180026652", "144777473879179858286456976737090791735"], "threshold":0.9}, "id":"ASB-A-380091558-ff9df06f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/48eb145c9c8a94f863070804175fbf6fb355f8a1", "target":{"file":"system/stack/btm/btm_sec.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/678f1a3dbc1e7b2d53063db7f5fab11c5e6d60e5"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["163089759142127586588324651590170982536", "185362144492042389778852082534923951970", "299146049654932286679684252146538042477", "245884674148920163474875848464493141963", "136040404144856022676109285507470382523", "268118490558179745562183388433856193629"], "threshold":0.9}, "id":"ASB-A-380091558-2415e0bb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/678f1a3dbc1e7b2d53063db7f5fab11c5e6d60e5", "target":{"file":"system/bta/jv/bta_jv_act.cc"}}, {"deprecated":false, "digest":{"line_hashes":["215369280184950385639233795273626289244", "123762443989841725281814036488747174660", "139217334984071104976834635057496087848", "280944670912963734861279569564561083451", "78603257810396034880921856202660379658"], "threshold":0.9}, "id":"ASB-A-380091558-2dabccf8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/678f1a3dbc1e7b2d53063db7f5fab11c5e6d60e5", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"131584299728825188974439019170440586434", "length":2476}, "id":"ASB-A-380091558-a2b97a37", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/678f1a3dbc1e7b2d53063db7f5fab11c5e6d60e5", "target":{"file":"system/bta/jv/bta_jv_act.cc", "function":"bta_jv_rfcomm_connect"}}, {"deprecated":false, "digest":{"function_hash":"315082393967161614135416274559428622968", "length":908}, "id":"ASB-A-380091558-ef254589", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/678f1a3dbc1e7b2d53063db7f5fab11c5e6d60e5", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_is_upgrade_possible"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/256b0e3a78e854a6796dbadebbf118141ae1248f"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"32332222465326117345079343273979226050", "length":910}, "id":"ASB-A-380091558-033993d2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/256b0e3a78e854a6796dbadebbf118141ae1248f", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_is_upgrade_possible"}}, {"deprecated":false, "digest":{"line_hashes":["165023310979350278205374289448802898061", "36467356241797826191898883367551871260", "56136246635340542338900908325101208086", "161240907973227795362103879973783025578", "147497994970655261063710976720259643055", "75711844978771333906290175064275198363"], "threshold":0.9}, "id":"ASB-A-380091558-2df0c40e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/256b0e3a78e854a6796dbadebbf118141ae1248f", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"line_hashes":["163089759142127586588324651590170982536", "185362144492042389778852082534923951970", "299146049654932286679684252146538042477", "245884674148920163474875848464493141963", "136040404144856022676109285507470382523", "268118490558179745562183388433856193629"], "threshold":0.9}, "id":"ASB-A-380091558-4e9b52b6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/256b0e3a78e854a6796dbadebbf118141ae1248f", "target":{"file":"system/bta/jv/bta_jv_act.cc"}}, {"deprecated":false, "digest":{"function_hash":"155286932709982901211941271820606969643", "length":2536}, "id":"ASB-A-380091558-fa832d64", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/256b0e3a78e854a6796dbadebbf118141ae1248f", "target":{"file":"system/bta/jv/bta_jv_act.cc", "function":"bta_jv_rfcomm_connect"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/92611bfc4d26f510490144f781662ccfc3da218e"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["267459501589051675215419896866954098335", "295577149032350445791988965255135284322", "289387393266665082225386809668131775522", "173461564977394523606803925134916891532"], "threshold":0.9}, "id":"ASB-A-380091558-319f916e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/92611bfc4d26f510490144f781662ccfc3da218e", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"42472635585583247353873066506413861035", "length":621}, "id":"ASB-A-380091558-3551fae5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/92611bfc4d26f510490144f781662ccfc3da218e", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_is_upgrade_possible"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}]}