CVE-2026-28606

A logic error in handleBondStateChanged of AdapterService.java in the Android Bluetooth stack allows the pairing process to be skipped. The flaw is triggered remotely during Bluetooth bond-state handling and, per the CVSS 3.1 vector (9.8, AV:N/AC:L/PR:N/UI:N), requires no user interaction and no additional privileges to exploit. A successful attacker gains escalation of privilege without user consent, effectively bypassing pairing protections to gain unauthorized pairing-level access to a device over Bluetooth. All Android devices running the affected AOSP Bluetooth component are potentially affected; the data does not specify affected version ranges or the bulletin that fixes it. As of this analysis there is no public proof-of-concept, the issue is not in the CISA KEV catalog, and EPSS assigns only a 0.2% probability of exploitation in the next 30 days.

What to do: Apply the Android security update that includes CVE-2026-28606 as soon as it is distributed by Google, the OEM, or the carrier, and confirm the device's security patch level afterward (Settings → About phone). As interim mitigation, disable Bluetooth when not in use and avoid accepting pairing requests from unknown nearby devices. Fleet admins should prioritize devices that regularly operate with Bluetooth enabled in shared or public environments.