{"id":"ASB-A-494698714","details":"In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-494698714","CVE-2026-28623"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Uwb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-494698714-019f143d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc","target":{"function":"BleRssiRangingCapabilities","file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"},"deprecated":false,"digest":{"function_hash":"108278290720239679670290440440392322747","length":71}},{"target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"},"deprecated":false,"digest":{"line_hashes":["204012525001559108782235403219108478679","187569734406896321495303847981575087234","267255789626835227532433911989106675992","250660792667184005819097613699372382536","176283397515609133376906112917801997820","210322198058638982558497118166790002943","40603449385196808248075477158306237415","59329535360363106393261951975453830599","301700961971174442897976110673898450586","310341500493676024418640814336177556771","78689538872497707212966449085667696718","80783595404497974553574806827402186688","91082541757506033222029177108748048269","21608815408419424727227153598238531026","254119666026835073656020205241719266606","197060925260166511203897146946149175096","179499170354934078207386004136237701396"],"threshold":0.9},"id":"ASB-A-494698714-33c3cbad","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc"},{"digest":{"length":147,"function_hash":"113321804291417090627673995063569967023"},"id":"ASB-A-494698714-538b0063","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc","target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java","function":"writeToParcel"},"deprecated":false},{"target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"},"deprecated":false,"digest":{"line_hashes":["202667314336398009209156024606124839753","112442619123434324403844188319436480122","286714684503839135315113132507452298409","279441281832181513377676629190945313465","53075187736716637660121079857369764113","100894727188581530539158517334920362355","124979582196544413952877238543174580481","312185364799000528640101359142966637793","99207034495214211093985260860797383376","268791713903081209834610455216417094906","181307563333794074935980124552325901167","74317915299882360200195483597557373869","1581358600775711250275706107949192019","78689538872497707212966449085667696718","80783595404497974553574806827402186688","296150751728844678143132772002309938344","257700493266476351746995991190186708125","235557414109060835432373469571294126022","44315011216095396783104128112960530246","114996820109834511627030117995803153279"],"threshold":0.9},"id":"ASB-A-494698714-851c949d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc"},{"target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java","function":"BleCsRangingCapabilities"},"deprecated":false,"digest":{"function_hash":"180091682304429905941699082791565262088","length":217},"id":"ASB-A-494698714-c90075bb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc"},{"digest":{"length":99,"function_hash":"71358053630364170390612900594189908239"},"id":"ASB-A-494698714-c964079b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/c8aed37c3cd8efdae7d2f52f27b5a99919d86cbc","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java","function":"writeToParcel"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494698714.json"}},{"package":{"name":"platform/packages/modules/Uwb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf"],"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["202667314336398009209156024606124839753","112442619123434324403844188319436480122","286714684503839135315113132507452298409","279441281832181513377676629190945313465","53075187736716637660121079857369764113","100894727188581530539158517334920362355","124979582196544413952877238543174580481","312185364799000528640101359142966637793","99207034495214211093985260860797383376","268791713903081209834610455216417094906","181307563333794074935980124552325901167","74317915299882360200195483597557373869","1581358600775711250275706107949192019","78689538872497707212966449085667696718","80783595404497974553574806827402186688","296150751728844678143132772002309938344","257700493266476351746995991190186708125","235557414109060835432373469571294126022","44315011216095396783104128112960530246","114996820109834511627030117995803153279"]},"id":"ASB-A-494698714-52fba6dc"},{"deprecated":false,"digest":{"function_hash":"180091682304429905941699082791565262088","length":217},"id":"ASB-A-494698714-6cdf8775","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf","target":{"function":"BleCsRangingCapabilities","file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"}},{"deprecated":false,"digest":{"function_hash":"113321804291417090627673995063569967023","length":147},"id":"ASB-A-494698714-9400de7e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf","target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java","function":"writeToParcel"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java","function":"writeToParcel"},"deprecated":false,"digest":{"length":99,"function_hash":"71358053630364170390612900594189908239"},"id":"ASB-A-494698714-a61bf241"},{"digest":{"function_hash":"108278290720239679670290440440392322747","length":71},"id":"ASB-A-494698714-d054d977","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java","function":"BleRssiRangingCapabilities"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["204012525001559108782235403219108478679","187569734406896321495303847981575087234","267255789626835227532433911989106675992","250660792667184005819097613699372382536","176283397515609133376906112917801997820","210322198058638982558497118166790002943","40603449385196808248075477158306237415","59329535360363106393261951975453830599","301700961971174442897976110673898450586","310341500493676024418640814336177556771","78689538872497707212966449085667696718","80783595404497974553574806827402186688","91082541757506033222029177108748048269","21608815408419424727227153598238531026","254119666026835073656020205241719266606","197060925260166511203897146946149175096","179499170354934078207386004136237701396"],"threshold":0.9},"id":"ASB-A-494698714-e72514a9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/1613745c4612b48d00e4068d8724c6146b7bf9bf","target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494698714.json"}},{"package":{"name":"platform/packages/modules/Uwb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java","function":"writeToParcel"},"deprecated":false,"digest":{"function_hash":"113321804291417090627673995063569967023","length":147},"id":"ASB-A-494698714-18258ebd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6"},{"id":"ASB-A-494698714-1a7fc23e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6","target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"},"deprecated":false,"digest":{"line_hashes":["204012525001559108782235403219108478679","187569734406896321495303847981575087234","267255789626835227532433911989106675992","250660792667184005819097613699372382536","176283397515609133376906112917801997820","210322198058638982558497118166790002943","40603449385196808248075477158306237415","59329535360363106393261951975453830599","301700961971174442897976110673898450586","310341500493676024418640814336177556771","78689538872497707212966449085667696718","80783595404497974553574806827402186688","91082541757506033222029177108748048269","21608815408419424727227153598238531026","254119666026835073656020205241719266606","197060925260166511203897146946149175096","179499170354934078207386004136237701396"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java","function":"BleRssiRangingCapabilities"},"deprecated":false,"digest":{"function_hash":"108278290720239679670290440440392322747","length":71},"id":"ASB-A-494698714-40c48ffb","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["202667314336398009209156024606124839753","112442619123434324403844188319436480122","286714684503839135315113132507452298409","279441281832181513377676629190945313465","53075187736716637660121079857369764113","100894727188581530539158517334920362355","124979582196544413952877238543174580481","312185364799000528640101359142966637793","99207034495214211093985260860797383376","268791713903081209834610455216417094906","181307563333794074935980124552325901167","74317915299882360200195483597557373869","1581358600775711250275706107949192019","78689538872497707212966449085667696718","80783595404497974553574806827402186688","296150751728844678143132772002309938344","257700493266476351746995991190186708125","235557414109060835432373469571294126022","44315011216095396783104128112960530246","114996820109834511627030117995803153279"],"threshold":0.9},"id":"ASB-A-494698714-544b8235","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"},"deprecated":false},{"digest":{"function_hash":"180091682304429905941699082791565262088","length":217},"id":"ASB-A-494698714-b763d974","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6","target":{"function":"BleCsRangingCapabilities","file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"},"deprecated":false},{"digest":{"function_hash":"71358053630364170390612900594189908239","length":99},"id":"ASB-A-494698714-fcacb04b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6","target":{"function":"writeToParcel","file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/295c0390ffd2670b951e636eb1d63bdd0940cff6"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494698714.json"}},{"package":{"name":"platform/packages/modules/Uwb","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc","target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"},"deprecated":false,"digest":{"line_hashes":["204012525001559108782235403219108478679","187569734406896321495303847981575087234","267255789626835227532433911989106675992","250660792667184005819097613699372382536","176283397515609133376906112917801997820","210322198058638982558497118166790002943","40603449385196808248075477158306237415","59329535360363106393261951975453830599","301700961971174442897976110673898450586","310341500493676024418640814336177556771","78689538872497707212966449085667696718","80783595404497974553574806827402186688","91082541757506033222029177108748048269","21608815408419424727227153598238531026","254119666026835073656020205241719266606","197060925260166511203897146946149175096","179499170354934078207386004136237701396"],"threshold":0.9},"id":"ASB-A-494698714-00a57a97"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java","function":"BleRssiRangingCapabilities"},"deprecated":false,"digest":{"length":71,"function_hash":"108278290720239679670290440440392322747"},"id":"ASB-A-494698714-3a9e13d6"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["202667314336398009209156024606124839753","112442619123434324403844188319436480122","286714684503839135315113132507452298409","279441281832181513377676629190945313465","53075187736716637660121079857369764113","100894727188581530539158517334920362355","124979582196544413952877238543174580481","312185364799000528640101359142966637793","99207034495214211093985260860797383376","268791713903081209834610455216417094906","181307563333794074935980124552325901167","74317915299882360200195483597557373869","1581358600775711250275706107949192019","78689538872497707212966449085667696718","80783595404497974553574806827402186688","296150751728844678143132772002309938344","257700493266476351746995991190186708125","235557414109060835432373469571294126022","44315011216095396783104128112960530246","114996820109834511627030117995803153279"]},"id":"ASB-A-494698714-5a0d3bc6","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"180091682304429905941699082791565262088","length":217},"id":"ASB-A-494698714-9d36efb1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc","target":{"file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java","function":"BleCsRangingCapabilities"}},{"deprecated":false,"digest":{"function_hash":"113321804291417090627673995063569967023","length":147},"id":"ASB-A-494698714-b6f1ecbd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc","target":{"function":"writeToParcel","file":"ranging/framework/java/android/ranging/ble/cs/BleCsRangingCapabilities.java"}},{"digest":{"function_hash":"71358053630364170390612900594189908239","length":99},"id":"ASB-A-494698714-bfe47dd4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc","target":{"file":"ranging/framework/java/android/ranging/ble/rssi/BleRssiRangingCapabilities.java","function":"writeToParcel"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Uwb/+/71b9ffb244d0fc2abaa31e6fe237b41454003cbc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-494698714.json"}}],"schema_version":"1.9.0"}