A flaw in AdapterService’s handleBondStateChanged allows a local process to read data that should be protected by stricter permissions. An attacker can learn sensitive information without needing higher privileges or user interaction. The flaw represents a classic information exposure issue.

The issue affects devices running Google Android. No specific OS version was enumerated in the advisory, so any build that includes the vulnerable AdapterService implementation could be impacted.

Because the flaw is local and does not require user interaction, an attacker with physical or local access to the device can exploit it immediately. The CVSS score is 3.3 and is considered low severity, and the EPSS metric is unavailable, so the exact threat level is uncertain, but the lack of required privileges makes it a high‑risk local vulnerability. The vulnerability is not listed in CISA's KEV catalog, implying no confirmed exploits yet, but the permission bypass suggests a straightforward attack path by invoking the vulnerable method.