high7.5

CVE-2025-0093

In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check.

Impact

In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Affected products

Vendor	Product	Affected versions
Google	Android	Versions 12.0, 12.1, 13.0, 14.0, 15.0

Weakness classification

CWE-732

References

NVD record
CVE.org record
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/090ca53cc13c12e3763777a6a3c7367641e9808f
https://source.android.com/security/bulletin/2025-03-01