Android Bluetooth EUVD-2026-33807

Attacker must be within Bluetooth radio range of the victim Android device and the target's Bluetooth radio must be powered on with LE scanning/advertising active (the default state on modern Android phones whenever Bluetooth is enabled, which is typical for users of wireless earbuds, watches, or car audio). The vulnerable code path is triggered during LE pairing specifically, so the attacker must initiate or coerce a pairing handshake; no victim tap, prompt acceptance, or unlock is required (UI:N confirmed by CVSS). Exploitation is limited to Android versions 14, 15, 16, and 16-qpr2 prior to the 2026-06-01 patch level, requires physical proximity (AV:A - not routable over IP), and cannot be automated at internet scale (SSVC Automatable: no), which constrains realistic abuse to targeted proximity attacks rather than mass campaigns.

The CVSS 3.1 vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 8.0 (High): adjacent network reach (Bluetooth radio range), low complexity, low privileges, and no user interaction with total CIA impact. CISA SSVC scoring is consistent on impact (total) but assesses Exploitation as 'none' and Automatable as 'no', indicating no observed in-the-wild abuse and that mass automation is impractical because each victim requires physical/RF proximity. There is no KEV listing, no EPSS score supplied, and no public exploit identified at time of analysis, so the realistic priority is moderate-to-high for high-value targets (executives, journalists, devices in dense public spaces) rather than internet-scale opportunistic attack. Note one tension worth flagging: the CVSS vector lists PR:L (some privileges required) but the description states 'no additional execution privileges needed' and 'User interaction is not needed' - the PR:L likely reflects that the attacker device must initiate a pairing session, not that the attacker must already have an Android account, and defenders should treat this as effectively unauthenticated from an attacker standpoint.

An attacker within Bluetooth radio range (typically 10-30 meters, extended with directional antennas) places a malicious LE peripheral near a target Android 14/15/16 device and initiates a pairing exchange that exercises the flawed logic path, causing the phone to complete bonding without ever prompting the user. Once bonded, the attacker's device is treated as a trusted peer and can interact with privileged Bluetooth profiles (HID, GATT services, file transfer) to escalate to higher-impact actions such as keystroke injection or data exfiltration. No public exploit identified at time of analysis, but the bug class is well-understood and previously seen in BlueBorne/BlueFrag-style research.