medium5.5

CVE-2024-49728

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy.

Impact

In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected versions
Google	Android	Versions 13.0, 14.0, 15.0

Weakness classification

CWE-610

References

NVD record
CVE.org record
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4b65cbb339db4d3a7a9a6100cb2e7c9f1ece9271
https://source.android.com/security/bulletin/2025-04-01