Google Android EUVD-2026-33779

Requires local code execution on the target device with a low-privileged user account (PR:L per CVSS) - equivalent to any standard installed Android application. The vulnerability is exercised through the Bluetooth bond state change handler, meaning Bluetooth functionality must be present and used on the device (pairing activity, or an attacker-triggered probe). No special system permissions or root access are required. What limits exploitation: the attacker cannot reach this remotely (AV:L - no network vector), the data exposed is limited to Bluetooth bonding metadata (C:L, not full credential or filesystem access), and no user interaction is needed but physical or software-level access to the device is a prerequisite. This is NOT exploitable against default configurations by a remote, unauthenticated attacker.

The CVSS 3.1 score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a low-severity, low-complexity local disclosure. Attack vector is Local, meaning an attacker must already have code executing on the target device - this eliminates remote network-based exploitation entirely. PR:L confirms the attacker needs only a standard low-privileged account, a common condition for any sideloaded or installed application. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability degradation. No EPSS data was provided; however, given the local-only vector, low confidentiality impact, and absence from CISA KEV, opportunistic mass exploitation is highly unlikely. This is a real but low-priority finding - most relevant in threat models involving malicious apps installed on a target device seeking to fingerprint paired Bluetooth peripherals. The 'Privilege Escalation' tag from the reporter is somewhat misleading: there is no privilege escalation in the traditional sense; the issue is a permission bypass enabling unauthorized data read, consistent with the CVSS profile.

A malicious Android application installed with standard user-level permissions registers to receive or directly triggers Bluetooth bond state change events via handleBondStateChanged, bypassing the permission gate that should restrict this data. The app silently enumerates paired Bluetooth devices or monitors pairing activity to profile the target user's peripherals (e.g., medical devices, keyboards, headsets). No user interaction is required after app installation, and no public exploit code exists at time of analysis.