Android CVE-2026-28606

Exploitation requires the target's Bluetooth to be enabled and the attacker to be within Bluetooth radio range and able to initiate a bonding exchange with the device; the pairing/consent step is what is bypassed, so no user approval and no prior authentication (PR:N/UI:N) are needed. Limiting factors: physical proximity (Bluetooth range, not Internet-wide despite AV:N), the device having Bluetooth on and reachable, and the target running Android 15, 16, 16-qpr2, or 17 without the 2026-09-01 patch level. No specific non-default configuration is called out in the description.

The signals conflict sharply and should be read together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a maximally severe, no-prerequisite remote escalation, and Google's SSVC 'Technical Impact: total' agrees the impact ceiling is complete device compromise. Counterweighing that, SSVC records Exploitation: none and Automatable: no, and EPSS is only 0.16% (5th percentile), so there is no evidence of exploitation and no public exploit at time of analysis. Importantly, Bluetooth is a radio-proximity technology: despite the AV:N label, realistic exploitation requires the attacker to be within Bluetooth range of the target, which materially limits mass or remote-Internet exploitation and makes this closer to a proximity attack than a wormable network one. The net picture is a genuinely high-severity, high-priority patch (total impact, zero user interaction, no privileges needed) but not an emergency-drop-everything item absent active exploitation; any organization managing a fleet of Android devices should treat the September bulletin as urgent and roll it out on their normal expedited cadence. Verify the AV:N assumption against your threat model - the description says 'remote' but the Bluetooth attack surface is proximity-bound.

An attacker within Bluetooth range of a victim's phone initiates a bond and, by exploiting the flawed handleBondStateChanged logic, is registered as a bonded/trusted device without the victim ever approving pairing. Having bypassed consent, the attacker gains the elevated Bluetooth privileges of a paired peer and can access device functions/data the pairing gate was meant to protect. No public proof-of-concept is identified, and no user interaction is required on the victim's side.