{"id":"ASB-A-495543559", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28606", "A-495543559"], "details":"In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/cb84e50dfff3de0fd9ef1a035f1d30ac0e2da615", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73dfe68af3684b6423d45ff13fecd44a8af72a31"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["172491551016081222509606975674606634929", "244122685222798084170938956986535782112", "180979562109266024854936587236355213934", "290626991207025086593717798318803165576"], "threshold":0.9}, "id":"ASB-A-495543559-096fbba8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73dfe68af3684b6423d45ff13fecd44a8af72a31", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"}}, {"deprecated":false, "digest":{"function_hash":"105262987424471197969920059015319929116", "length":1110}, "id":"ASB-A-495543559-6542e760", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73dfe68af3684b6423d45ff13fecd44a8af72a31", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"handleBondStateChanged"}}, {"deprecated":false, "digest":{"line_hashes":["158278517121279925669763459396050736212", "288739017718904460659335261141457833435", "6339770018572496753974592902620092815", "203885456434458078329517005134652568214", "130492626256820461490265342344428510075", "82457354660226965921242225205074833471", "320556176920368453636953427723335118174", "231091355495047866554981881224867700703"], "threshold":0.9}, "id":"ASB-A-495543559-984fccb5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/cb84e50dfff3de0fd9ef1a035f1d30ac0e2da615", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"}}, {"deprecated":false, "digest":{"function_hash":"63962970782986755239838304677188422218", "length":1088}, "id":"ASB-A-495543559-a2e319ec", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/cb84e50dfff3de0fd9ef1a035f1d30ac0e2da615", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"handleBondStateChanged"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ef637a080868cee47011670ade6c3a0792338186"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"97308379436756897466670353974153959495", "length":1607}, "id":"ASB-A-495543559-52b04324", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ef637a080868cee47011670ade6c3a0792338186", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"handleBondStateChanged"}}, {"deprecated":false, "digest":{"line_hashes":["291622558848612185938810371525212411349", "6339770018572496753974592902620092815", "297220356378473033162497479905122016496", "130492626256820461490265342344428510075", "82457354660226965921242225205074833471", "139896610198477439263271941636797521166", "183066167480642512050655114097581296522"], "threshold":0.9}, "id":"ASB-A-495543559-fae6b019", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ef637a080868cee47011670ade6c3a0792338186", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/954c78b3edc56df8c9e78f61727d5484cd569697"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"76127433488301755422542414307284142255", "length":1607}, "id":"ASB-A-495543559-b2dcc201", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/954c78b3edc56df8c9e78f61727d5484cd569697", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"handleBondStateChanged"}}, {"deprecated":false, "digest":{"line_hashes":["158278517121279925669763459396050736212", "288739017718904460659335261141457833435", "317145879494996986270967256458403743819", "612107303572843322184623293870716560", "130492626256820461490265342344428510075", "82457354660226965921242225205074833471", "139896610198477439263271941636797521166", "183066167480642512050655114097581296522"], "threshold":0.9}, "id":"ASB-A-495543559-b2e0fe7d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/954c78b3edc56df8c9e78f61727d5484cd569697", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f64b2e06b7863df56d51b99c27649591f02e7f51"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"325301207256667247340662207679404637020", "length":1013}, "id":"ASB-A-495543559-24e091b5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f64b2e06b7863df56d51b99c27649591f02e7f51", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"handleBondStateChanged"}}, {"deprecated":false, "digest":{"line_hashes":["158278517121279925669763459396050736212", "288739017718904460659335261141457833435", "337436913090766349708475728239790242289", "1746000386138273993207109485612971968", "130492626256820461490265342344428510075", "82457354660226965921242225205074833471", "320556176920368453636953427723335118174", "231091355495047866554981881224867700703"], "threshold":0.9}, "id":"ASB-A-495543559-9a032d5d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f64b2e06b7863df56d51b99c27649591f02e7f51", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b8b101ed57a7c3affdcc293036c5f1a5e98ad329"], "severity":"High", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["172491551016081222509606975674606634929", "244122685222798084170938956986535782112", "180979562109266024854936587236355213934", "290626991207025086593717798318803165576"], "threshold":0.9}, "id":"ASB-A-495543559-5885a5a8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b8b101ed57a7c3affdcc293036c5f1a5e98ad329", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"}}, {"deprecated":false, "digest":{"function_hash":"105262987424471197969920059015319929116", "length":1110}, "id":"ASB-A-495543559-e0f94f02", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b8b101ed57a7c3affdcc293036c5f1a5e98ad329", "target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java", "function":"handleBondStateChanged"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}