{"id":"ASB-A-494698714", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28623", "A-494698714"], "details":"In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Uwb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"108278290720239679670290440440392322747", "length":71}, "id":"ASB-A-494698714-019f143d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java", "function":"BleRssiRangingCapabilities"}}, {"deprecated":false, "digest":{"line_hashes":["204012525001559108782235403219108478679", "187569734406896321495303847981575087234", "267255789626835227532433911989106675992", "250660792667184005819097613699372382536", "176283397515609133376906112917801997820", "210322198058638982558497118166790002943", "40603449385196808248075477158306237415", "59329535360363106393261951975453830599", "301700961971174442897976110673898450586", "310341500493676024418640814336177556771", "78689538872497707212966449085667696718", "80783595404497974553574806827402186688", "91082541757506033222029177108748048269", "21608815408419424727227153598238531026", "254119666026835073656020205241719266606", "197060925260166511203897146946149175096", "179499170354934078207386004136237701396"], "threshold":0.9}, "id":"ASB-A-494698714-33c3cbad", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"}}, {"deprecated":false, "digest":{"function_hash":"113321804291417090627673995063569967023", "length":147}, "id":"ASB-A-494698714-538b0063", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java", "function":"writeToParcel"}}, {"deprecated":false, "digest":{"line_hashes":["202667314336398009209156024606124839753", "112442619123434324403844188319436480122", "286714684503839135315113132507452298409", "279441281832181513377676629190945313465", "53075187736716637660121079857369764113", "100894727188581530539158517334920362355", "124979582196544413952877238543174580481", "312185364799000528640101359142966637793", "99207034495214211093985260860797383376", "268791713903081209834610455216417094906", "181307563333794074935980124552325901167", "74317915299882360200195483597557373869", "1581358600775711250275706107949192019", "78689538872497707212966449085667696718", "80783595404497974553574806827402186688", "296150751728844678143132772002309938344", "257700493266476351746995991190186708125", "235557414109060835432373469571294126022", "44315011216095396783104128112960530246", "114996820109834511627030117995803153279"], "threshold":0.9}, "id":"ASB-A-494698714-851c949d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"}}, {"deprecated":false, "digest":{"function_hash":"180091682304429905941699082791565262088", "length":217}, "id":"ASB-A-494698714-c90075bb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java", "function":"BleCsRangingCapabilities"}}, {"deprecated":false, "digest":{"function_hash":"71358053630364170390612900594189908239", "length":99}, "id":"ASB-A-494698714-c964079b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java", "function":"writeToParcel"}}]}}, {"package":{"name":"platform/packages/modules/Uwb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["202667314336398009209156024606124839753", "112442619123434324403844188319436480122", "286714684503839135315113132507452298409", "279441281832181513377676629190945313465", "53075187736716637660121079857369764113", "100894727188581530539158517334920362355", "124979582196544413952877238543174580481", "312185364799000528640101359142966637793", "99207034495214211093985260860797383376", "268791713903081209834610455216417094906", "181307563333794074935980124552325901167", "74317915299882360200195483597557373869", "1581358600775711250275706107949192019", "78689538872497707212966449085667696718", "80783595404497974553574806827402186688", "296150751728844678143132772002309938344", "257700493266476351746995991190186708125", "235557414109060835432373469571294126022", "44315011216095396783104128112960530246", "114996820109834511627030117995803153279"], "threshold":0.9}, "id":"ASB-A-494698714-52fba6dc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"}}, {"deprecated":false, "digest":{"function_hash":"180091682304429905941699082791565262088", "length":217}, "id":"ASB-A-494698714-6cdf8775", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java", "function":"BleCsRangingCapabilities"}}, {"deprecated":false, "digest":{"function_hash":"113321804291417090627673995063569967023", "length":147}, "id":"ASB-A-494698714-9400de7e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java", "function":"writeToParcel"}}, {"deprecated":false, "digest":{"function_hash":"71358053630364170390612900594189908239", "length":99}, "id":"ASB-A-494698714-a61bf241", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java", "function":"writeToParcel"}}, {"deprecated":false, "digest":{"function_hash":"108278290720239679670290440440392322747", "length":71}, "id":"ASB-A-494698714-d054d977", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java", "function":"BleRssiRangingCapabilities"}}, {"deprecated":false, "digest":{"line_hashes":["204012525001559108782235403219108478679", "187569734406896321495303847981575087234", "267255789626835227532433911989106675992", "250660792667184005819097613699372382536", "176283397515609133376906112917801997820", "210322198058638982558497118166790002943", "40603449385196808248075477158306237415", "59329535360363106393261951975453830599", "301700961971174442897976110673898450586", "310341500493676024418640814336177556771", "78689538872497707212966449085667696718", "80783595404497974553574806827402186688", "91082541757506033222029177108748048269", "21608815408419424727227153598238531026", "254119666026835073656020205241719266606", "197060925260166511203897146946149175096", "179499170354934078207386004136237701396"], "threshold":0.9}, "id":"ASB-A-494698714-e72514a9", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"}}]}}, {"package":{"name":"platform/packages/modules/Uwb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"113321804291417090627673995063569967023", "length":147}, "id":"ASB-A-494698714-18258ebd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java", "function":"writeToParcel"}}, {"deprecated":false, "digest":{"line_hashes":["204012525001559108782235403219108478679", "187569734406896321495303847981575087234", "267255789626835227532433911989106675992", "250660792667184005819097613699372382536", "176283397515609133376906112917801997820", "210322198058638982558497118166790002943", "40603449385196808248075477158306237415", "59329535360363106393261951975453830599", "301700961971174442897976110673898450586", "310341500493676024418640814336177556771", "78689538872497707212966449085667696718", "80783595404497974553574806827402186688", "91082541757506033222029177108748048269", "21608815408419424727227153598238531026", "254119666026835073656020205241719266606", "197060925260166511203897146946149175096", "179499170354934078207386004136237701396"], "threshold":0.9}, "id":"ASB-A-494698714-1a7fc23e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"}}, {"deprecated":false, "digest":{"function_hash":"108278290720239679670290440440392322747", "length":71}, "id":"ASB-A-494698714-40c48ffb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java", "function":"BleRssiRangingCapabilities"}}, {"deprecated":false, "digest":{"line_hashes":["202667314336398009209156024606124839753", "112442619123434324403844188319436480122", "286714684503839135315113132507452298409", "279441281832181513377676629190945313465", "53075187736716637660121079857369764113", "100894727188581530539158517334920362355", "124979582196544413952877238543174580481", "312185364799000528640101359142966637793", "99207034495214211093985260860797383376", "268791713903081209834610455216417094906", "181307563333794074935980124552325901167", "74317915299882360200195483597557373869", "1581358600775711250275706107949192019", "78689538872497707212966449085667696718", "80783595404497974553574806827402186688", "296150751728844678143132772002309938344", "257700493266476351746995991190186708125", "235557414109060835432373469571294126022", "44315011216095396783104128112960530246", "114996820109834511627030117995803153279"], "threshold":0.9}, "id":"ASB-A-494698714-544b8235", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"}}, {"deprecated":false, "digest":{"function_hash":"180091682304429905941699082791565262088", "length":217}, "id":"ASB-A-494698714-b763d974", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java", "function":"BleCsRangingCapabilities"}}, {"deprecated":false, "digest":{"function_hash":"71358053630364170390612900594189908239", "length":99}, "id":"ASB-A-494698714-fcacb04b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java", "function":"writeToParcel"}}]}}, {"package":{"name":"platform/packages/modules/Uwb", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["204012525001559108782235403219108478679", "187569734406896321495303847981575087234", "267255789626835227532433911989106675992", "250660792667184005819097613699372382536", "176283397515609133376906112917801997820", "210322198058638982558497118166790002943", "40603449385196808248075477158306237415", "59329535360363106393261951975453830599", "301700961971174442897976110673898450586", "310341500493676024418640814336177556771", "78689538872497707212966449085667696718", "80783595404497974553574806827402186688", "91082541757506033222029177108748048269", "21608815408419424727227153598238531026", "254119666026835073656020205241719266606", "197060925260166511203897146946149175096", "179499170354934078207386004136237701396"], "threshold":0.9}, "id":"ASB-A-494698714-00a57a97", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"}}, {"deprecated":false, "digest":{"function_hash":"108278290720239679670290440440392322747", "length":71}, "id":"ASB-A-494698714-3a9e13d6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java", "function":"BleRssiRangingCapabilities"}}, {"deprecated":false, "digest":{"line_hashes":["202667314336398009209156024606124839753", "112442619123434324403844188319436480122", "286714684503839135315113132507452298409", "279441281832181513377676629190945313465", "53075187736716637660121079857369764113", "100894727188581530539158517334920362355", "124979582196544413952877238543174580481", "312185364799000528640101359142966637793", "99207034495214211093985260860797383376", "268791713903081209834610455216417094906", "181307563333794074935980124552325901167", "74317915299882360200195483597557373869", "1581358600775711250275706107949192019", "78689538872497707212966449085667696718", "80783595404497974553574806827402186688", "296150751728844678143132772002309938344", "257700493266476351746995991190186708125", "235557414109060835432373469571294126022", "44315011216095396783104128112960530246", "114996820109834511627030117995803153279"], "threshold":0.9}, "id":"ASB-A-494698714-5a0d3bc6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"}}, {"deprecated":false, "digest":{"function_hash":"180091682304429905941699082791565262088", "length":217}, "id":"ASB-A-494698714-9d36efb1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java", "function":"BleCsRangingCapabilities"}}, {"deprecated":false, "digest":{"function_hash":"113321804291417090627673995063569967023", "length":147}, "id":"ASB-A-494698714-b6f1ecbd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java", "function":"writeToParcel"}}, {"deprecated":false, "digest":{"function_hash":"71358053630364170390612900594189908239", "length":99}, "id":"ASB-A-494698714-bfe47dd4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc", "target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java", "function":"writeToParcel"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}