CVE-2026-28606 Overview
CVE-2026-28606 is an authentication bypass vulnerability in the Android Bluetooth stack. The flaw resides in the handleBondStateChanged method of AdapterService.java. A logic error allows an attacker to skip the pairing process entirely. Successful exploitation results in remote privilege escalation without user consent or interaction.
The vulnerability is classified under [CWE-287] Improper Authentication. It is addressed in the Android Security Bulletin September 2026.
Critical Impact
An unauthenticated remote attacker in Bluetooth range can bypass the bonding process and escalate privileges on affected Android devices with no user interaction required.
Affected Products
- Android Open Source Project (AOSP) — Bluetooth stack (AdapterService)
- Android devices missing the September 2026 security patch level
- OEM Android builds inheriting the unpatched Bluetooth component
Discovery Timeline
- 2026-09-08 - CVE-2026-28606 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28606
Vulnerability Analysis
The vulnerability lives in handleBondStateChanged inside AdapterService.java, the core component that manages Bluetooth adapter state and bonding transitions. A logic error in the state-handling path allows the bond state to transition to a bonded value without the pairing process completing successfully. The device treats the remote peer as trusted and grants access reserved for paired devices.
Because bonding is the trust anchor for Bluetooth profile access, skipping pairing collapses the primary boundary between untrusted peers and privileged Bluetooth services. An attacker gains access to profiles and interfaces that assume a verified pairing occurred.
Root Cause
The root cause is improper authentication [CWE-287] in the bond-state transition logic. handleBondStateChanged fails to validate that a legitimate pairing exchange preceded the transition to the bonded state. The method accepts a state change that should require successful key exchange, effectively promoting an unauthenticated peer to a trusted state.
Attack Vector
Exploitation occurs over the network-reachable Bluetooth interface with no privileges and no user interaction. An attacker within radio range crafts bonding-related events that drive AdapterService through the flawed state path. Once the target treats the attacker as bonded, the attacker can invoke Bluetooth profiles that expose sensitive data or execution surface, resulting in escalation of privilege.
No verified public proof-of-concept is available at the time of publication. Refer to the Android Security Bulletin September 2026 for authoritative technical details and the AOSP patch commit.
Detection Methods for CVE-2026-28606
Indicators of Compromise
- Bluetooth bond state transitions to BOND_BONDED without corresponding pairing dialog events or PIN/passkey exchange in logcat.
- Unexpected entries in the Bluetooth bonded-devices list for peers the user did not knowingly pair.
- Bluetooth HAL or bluetooth process activity accessing profile services immediately after an unsolicited bond event.
Detection Strategies
- Monitor Android logcat for AdapterService bond-state changes that reach BOND_BONDED without preceding BOND_BONDING handshake logs.
- Correlate Bluetooth connection events with user-facing pairing prompts using MDM telemetry to flag silent bonds.
- Track device security patch level via enterprise mobility management and alert on devices below the September 2026 patch level.
Monitoring Recommendations
- Ingest Android device logs and MDM Bluetooth events into a centralized data lake for correlation across the fleet.
- Alert on the appearance of new bonded Bluetooth peers on managed devices in sensitive environments.
- Baseline Bluetooth activity per device class and flag anomalies in bond frequency or unknown peer MAC prefixes.
How to Mitigate CVE-2026-28606
Immediate Actions Required
- Apply the September 2026 Android security patch level or later on all managed devices.
- Disable Bluetooth on devices that cannot be patched, especially in high-risk or public environments.
- Enforce a minimum patch-level compliance policy through enterprise mobility management and block non-compliant devices from corporate resources.
Patch Information
Google addressed the vulnerability in the September 2026 Android Security Bulletin. OEMs incorporate the AOSP fix into their monthly device patches. Devices must report a security patch level of 2026-09-01 or later to include this fix. See the Android Security Bulletin September 2026 for the source patch reference and OEM guidance.
Workarounds
- Turn Bluetooth off when not in active use to remove the attack surface entirely.
- Set Bluetooth to non-discoverable mode and unpair unknown or unused devices.
- Restrict Bluetooth usage through MDM profiles on devices handling sensitive data until patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.