Description
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-09-08
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Local Information Disclosure
Action: Apply Patch
AI Analysis

Impact

A missing permission check (CWE-862) in the writeToParcel method of BleRssiRangingCapabilities.java allows a local application to read the Bluetooth MAC address without requiring additional privileges or user interaction. The flaw exposes a unique hardware identifier that can be used for tracking or profiling a device.

Affected Systems

Google Android devices that incorporate BleRssiRangingCapabilities.java are affected. No specific Android release is identified, so the vulnerability may exist in any build that contains the unpatched Bluetooth RSSI ranging implementation.

Risk and Exploitability

The CVSS score of 3.3 classifies the severity as low, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can obtain the MAC address by invoking the affected method from a malicious application on the same device, with no user consent or elevated rights. While the impact is limited to information disclosure, the exposed identifier can be leveraged for device profiling or other privacy‑related attacks.

Generated by OpenCVE AI on September 11, 2026 at 06:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Android firmware update that includes the correction of the permission check in BleRssiRangingCapabilities.java.
  • Restrict non‑trusted applications from accessing Bluetooth services by removing or tightening the BLUETOOTH permission in their manifest and disabling BLE functionality where possible.
  • Monitor system logs and application activity for anomalous calls to Bluetooth RSSI ranging methods, and investigate any unexpected attempts to read the MAC address.

Generated by OpenCVE AI on September 11, 2026 at 06:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*
cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Fri, 11 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Title Local Bluetooth MAC Address Disclosure via BleRssiRangingCapabilities

Thu, 10 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Bluetooth MAC Address Disclosure from Missing Permission Check in Android
Weaknesses CWE-200
CWE-284

Thu, 10 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
Title Bluetooth MAC Address Disclosure from Missing Permission Check in Android
Weaknesses CWE-200
CWE-284

Tue, 08 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Description In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2026-09-10T17:07:24.248Z

Reserved: 2026-03-02T19:11:11.728Z

Link: CVE-2026-28623

cve-icon Vulnrichment

Updated: 2026-09-10T17:07:17.791Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T19:17:54.320

Modified: 2026-09-15T14:07:49.123

Link: CVE-2026-28623

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T20:30:02Z

Weaknesses