CVE-2026-28623 Overview
CVE-2026-28623 is a local information disclosure vulnerability in the Android Bluetooth stack. The flaw resides in the writeToParcel method of BleRssiRangingCapabilities.java, where a missing permission check allows an unauthorized local application to read the device Bluetooth MAC address. Exploitation requires no user interaction and no elevated privileges beyond a low-privileged local context. The issue is tracked under CWE-862: Missing Authorization and is addressed in the Android Security Bulletin September 2026.
Critical Impact
A local app without Bluetooth permissions can obtain the device Bluetooth MAC address, enabling persistent device tracking across app sessions and reinstalls.
Affected Products
- Android platform component: BleRssiRangingCapabilities (Bluetooth stack)
- Android versions referenced in the September 2026 Security Bulletin
- Devices consuming AOSP Bluetooth ranging APIs
Discovery Timeline
- 2026-09-08 - CVE-2026-28623 published to NVD
- 2026-09-01 - Fix included in the Android Security Bulletin September 2026
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-28623
Vulnerability Analysis
The vulnerability exists in the writeToParcel implementation of the BleRssiRangingCapabilities class within the Android Bluetooth stack. writeToParcel serializes object state so it can be transported across process boundaries via Android's Binder IPC. The serialized payload includes the device Bluetooth MAC address, a value Android otherwise protects behind the LOCAL_MAC_ADDRESS and Bluetooth runtime permissions.
Because the method omits a permission check before writing the MAC address to the parcel, any local process that can obtain or receive a BleRssiRangingCapabilities object reads the address directly from the serialized data. The Bluetooth MAC address is a stable hardware identifier and can be used to correlate a device across applications, sessions, and reinstalls, defeating Android's privacy protections around persistent identifiers.
Root Cause
The root cause is a missing authorization check [CWE-862]. Android normally gates access to hardware identifiers behind runtime permissions and app-ops. The writeToParcel path in BleRssiRangingCapabilities.java serializes the MAC address without verifying that the caller holds the required Bluetooth or local MAC address permission.
Attack Vector
Exploitation is local. A malicious application installed on the device requests or receives the BleRssiRangingCapabilities parcelable and reads the MAC field from the deserialized payload. No user interaction, no prompt, and no additional privilege grant are required. The confidentiality impact is limited to the MAC address; there is no integrity or availability impact.
No public proof-of-concept, exploit module, or in-the-wild activity has been reported for this CVE. Refer to the Android Security Bulletin September 2026 for source-level fix details.
Detection Methods for CVE-2026-28623
Indicators of Compromise
- Installed applications that request BluetoothManager or Bluetooth ranging APIs without declaring corresponding permissions in the manifest.
- Unexpected process invocations reading BleRssiRangingCapabilities parcelables from Binder transactions.
- Outbound telemetry from third-party apps containing device Bluetooth MAC address values.
Detection Strategies
- Inspect installed APKs for calls into Bluetooth ranging APIs where the app manifest does not declare BLUETOOTH_CONNECT or LOCAL_MAC_ADDRESS.
- Audit MDM inventory for devices running an Android security patch level earlier than 2026-09-01.
- Correlate Binder IPC traces on rooted test devices to identify calls that return BleRssiRangingCapabilities to unprivileged callers.
Monitoring Recommendations
- Track Android security patch level compliance across the mobile fleet through MDM reporting.
- Alert when new applications request Bluetooth-adjacent APIs on devices missing the September 2026 patch.
- Monitor DNS and network egress for known trackers that ingest Bluetooth MAC identifiers.
How to Mitigate CVE-2026-28623
Immediate Actions Required
- Apply the Android security patch level 2026-09-01 or later on all managed devices.
- Enforce a minimum patch level policy through mobile device management to block non-compliant devices from sensitive resources.
- Review sideloaded applications and remove any that request Bluetooth APIs without a business justification.
Patch Information
The fix is included in the Android Security Bulletin September 2026. Device manufacturers ship the corrected BleRssiRangingCapabilities.writeToParcel implementation with the 2026-09-01 patch level. Verify the patch level under Settings → About phone → Android security update.
Workarounds
- Restrict installation of untrusted applications via MDM policy until the patch is deployed.
- Disable Bluetooth on affected devices when not actively in use to reduce exposure of the MAC address to enumeration paths.
- Use work profile isolation to keep corporate data segregated from personal apps that could harvest device identifiers.
# Verify Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
