CVE-2026-0045: Android Bluetooth Bonding Bypass Privilege Escalation

Technical summary

CVE-2026-0045 is a privilege escalation vulnerability in the bta_jv_rfcomm_connect function within bta_jv_act.cc. The underlying flaw is a logic error that fails to properly enforce bonding verification before establishing secure RFCOMM (serial port) connections. This allows a local process running with limited privileges to communicate with Bluetooth services that should require prior pairing, effectively bypassing a critical security boundary. The vulnerability affects the Bluetooth stack's assumption that connections are restricted to authenticated peers.

Business impact

If exploited, this vulnerability could permit unauthorized local applications to access sensitive Bluetooth-connected peripherals and device features—such as audio controls, health sensors, or critical device settings—without proper authentication. In enterprise environments where device pairing is part of security policy, this bypass undermines trust boundaries and could enable lateral movement or data exfiltration. For consumer devices, it increases the risk of malicious apps gaining unauthorized control over Bluetooth capabilities.

Affected systems

Google Android is affected across multiple versions. The vulnerability exists in the Bluetooth service framework, meaning any Android device using the standard Bluetooth stack is potentially vulnerable. Verify the specific Android version ranges in Google's official security bulletin and your device's update status.

Exploitability

Exploitation requires local access to the device and execution context with at least limited privileges. No special permissions, user interaction, or network access is needed. Once an attacker has local code execution (e.g., a malicious app installed), they can trigger the vulnerability directly. The attack surface is moderate within a single device but significant for rooted devices or those where untrusted apps may be installed.

Remediation

Update to a patched Android version as released by Google. The fix corrects the logic error in the RFCOMM connection handler to properly validate bonding status before allowing secure connections. Verify the exact patched versions against Google's official Android Security & Privacy Year in Review bulletin for June 2026.

Patch guidance

Monitor Google's official security bulletins for Android patches addressing CVE-2026-0045. Updates are typically rolled out via monthly security patches or major OS releases. Enable automatic updates on all Android devices to minimize the window of exposure. Manufacturers may distribute patches on different timelines; check with your device OEM for availability on your specific model.

Detection guidance

Monitor for unusual local Bluetooth connection activity, particularly from processes that lack standard Bluetooth permissions or that bypass the normal pairing flow. Kernel and Bluetooth logs may show unexpected RFCOMM connections being established without corresponding bonding records. Network and endpoint detection tools should flag connections to Bluetooth services from unexpected local callers.

Why prioritize this

This vulnerability merits high priority due to its LOCAL attack vector combined with HIGH CVSS severity (7.8), unrestricted impact across confidentiality, integrity, and availability, and the complete absence of barriers (no user interaction, no special privileges required beyond local access). Any installed app or local process can exploit it. For enterprises, this represents a direct threat to device security posture; for consumer users, it opens the door to unauthorized control of Bluetooth devices.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: AV:L (local attack only, limiting immediate external reach); AC:L (no complex conditions or race conditions required); PR:L (requires low-privilege local access, common in multi-user or app-sandboxed scenarios); UI:N (no user interaction needed); S:U (impact is scoped to the affected device); C:H/I:H/A:H (all three security dimensions fully compromised—an attacker can read, modify, and disrupt Bluetooth services). The severity is not CRITICAL because it requires prior local access, but it remains HIGH-priority for any organization managing Android fleets.

Frequently asked questions