{"id":"ASB-A-495543559","details":"In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-495543559","CVE-2026-28606"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["172491551016081222509606975674606634929","244122685222798084170938956986535782112","180979562109266024854936587236355213934","290626991207025086593717798318803165576"],"threshold":0.9},"id":"ASB-A-495543559-096fbba8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73dfe68af3684b6423d45ff13fecd44a8af72a31","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false},{"id":"ASB-A-495543559-6542e760","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73dfe68af3684b6423d45ff13fecd44a8af72a31","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"handleBondStateChanged"},"deprecated":false,"digest":{"function_hash":"105262987424471197969920059015319929116","length":1110}},{"target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"line_hashes":["158278517121279925669763459396050736212","288739017718904460659335261141457833435","6339770018572496753974592902620092815","203885456434458078329517005134652568214","130492626256820461490265342344428510075","82457354660226965921242225205074833471","320556176920368453636953427723335118174","231091355495047866554981881224867700703"],"threshold":0.9},"id":"ASB-A-495543559-984fccb5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/cb84e50dfff3de0fd9ef1a035f1d30ac0e2da615"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/cb84e50dfff3de0fd9ef1a035f1d30ac0e2da615","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"handleBondStateChanged"},"deprecated":false,"digest":{"length":1088,"function_hash":"63962970782986755239838304677188422218"},"id":"ASB-A-495543559-a2e319ec","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/cb84e50dfff3de0fd9ef1a035f1d30ac0e2da615","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73dfe68af3684b6423d45ff13fecd44a8af72a31"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495543559.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"97308379436756897466670353974153959495","length":1607},"id":"ASB-A-495543559-52b04324","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ef637a080868cee47011670ade6c3a0792338186","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"handleBondStateChanged"},"deprecated":false},{"target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["291622558848612185938810371525212411349","6339770018572496753974592902620092815","297220356378473033162497479905122016496","130492626256820461490265342344428510075","82457354660226965921242225205074833471","139896610198477439263271941636797521166","183066167480642512050655114097581296522"]},"id":"ASB-A-495543559-fae6b019","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ef637a080868cee47011670ade6c3a0792338186"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ef637a080868cee47011670ade6c3a0792338186"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495543559.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"76127433488301755422542414307284142255","length":1607},"id":"ASB-A-495543559-b2dcc201","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/954c78b3edc56df8c9e78f61727d5484cd569697","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"handleBondStateChanged"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/954c78b3edc56df8c9e78f61727d5484cd569697","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"line_hashes":["158278517121279925669763459396050736212","288739017718904460659335261141457833435","317145879494996986270967256458403743819","612107303572843322184623293870716560","130492626256820461490265342344428510075","82457354660226965921242225205074833471","139896610198477439263271941636797521166","183066167480642512050655114097581296522"],"threshold":0.9},"id":"ASB-A-495543559-b2e0fe7d"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/954c78b3edc56df8c9e78f61727d5484cd569697"],"severity":"High","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495543559.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-495543559-24e091b5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f64b2e06b7863df56d51b99c27649591f02e7f51","target":{"function":"handleBondStateChanged","file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"length":1013,"function_hash":"325301207256667247340662207679404637020"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f64b2e06b7863df56d51b99c27649591f02e7f51","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"line_hashes":["158278517121279925669763459396050736212","288739017718904460659335261141457833435","337436913090766349708475728239790242289","1746000386138273993207109485612971968","130492626256820461490265342344428510075","82457354660226965921242225205074833471","320556176920368453636953427723335118174","231091355495047866554981881224867700703"],"threshold":0.9},"id":"ASB-A-495543559-9a032d5d"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f64b2e06b7863df56d51b99c27649591f02e7f51"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495543559.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b8b101ed57a7c3affdcc293036c5f1a5e98ad329","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java"},"deprecated":false,"digest":{"line_hashes":["172491551016081222509606975674606634929","244122685222798084170938956986535782112","180979562109266024854936587236355213934","290626991207025086593717798318803165576"],"threshold":0.9},"id":"ASB-A-495543559-5885a5a8"},{"id":"ASB-A-495543559-e0f94f02","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b8b101ed57a7c3affdcc293036c5f1a5e98ad329","target":{"file":"android/app/src/com/android/bluetooth/btservice/AdapterService.java","function":"handleBondStateChanged"},"deprecated":false,"digest":{"function_hash":"105262987424471197969920059015319929116","length":1110}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b8b101ed57a7c3affdcc293036c5f1a5e98ad329"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-495543559.json"}}],"schema_version":"1.9.0"}