medium6.5

CVE-2025-0092

In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI.

Impact

In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Affected products

Vendor	Product	Affected versions
Google	Android	Versions 12.0, 12.1, 13.0, 14.0, 15.0

Weakness classification

CWE-345 CWE-356

References

NVD record
CVE.org record
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/090ca53cc13c12e3763777a6a3c7367641e9808f
https://source.android.com/security/bulletin/2025-03-01