Android EUVD-2025-210215

Exploitation requires (1) the attacker to be within proximal/adjacent range of the target device (AV:A - e.g., Bluetooth/hybrid caBLE or local pairing channel used for cross-device passkeys), (2) some pre-existing limited privilege on or near the device (PR:L), and (3) the target running the affected Android 17 passkey pairing feature. The specific condition is that a third-party passkey entry pairing approval proceeds without the required permission check across multiple code paths. No user interaction is required (UI:N), which removes a key limiting factor, but exploitation is meaningfully limited by the need for physical/radio proximity and an existing privilege level - it cannot be performed remotely over the internet or against a device that is out of range or not using the passkey pairing flow.

Signals are mixed but coherent. CVSS 8.0 (High) with AV:A/AC:L/PR:L/UI:N and total C/I/A impact reflects a serious authorization bypass, and CISA's SSVC framework rates Technical Impact as 'total' - consistent with full credential escalation. However, the mitigating signals are strong: Exploitation status is 'none', Automatable is 'no', EPSS is only 0.13% (3rd percentile), the vulnerability is not on CISA KEV, and there is no public exploit. The adjacent (not network) vector plus a required PR:L (some existing privilege on/near the device) means an attacker must already be within radio/proximal range and hold limited privileges, which meaningfully constrains mass exploitation. Net assessment: a genuinely high-severity local/proximal authorization flaw worth patching promptly on managed and high-value devices, but not an internet-facing, wormable, or actively-exploited emergency - real-world risk is currently targeted/opportunistic rather than widespread. Note one point to verify: the description phrases impact as 'escalation of privilege with no additional execution privileges needed,' which aligns with PR:L in the vector; treat the exact required privilege level as vendor-confirmed via the Android bulletin.

An attacker within Bluetooth/proximal range of a victim's Android 17 device, holding limited local privileges, triggers a third-party passkey entry pairing; because the permission check is missing, the pairing is approved without the victim's consent or interaction, letting the attacker bind and use the victim's passkey credential. No public exploit code is known, and the adjacent vector with low attack complexity means the main barrier is physical/radio proximity plus the existing PR:L foothold.