CVE-2026-28627: Bluetooth Security Information Disclosure

CVE-2026-28627 Overview

CVE-2026-28627 is a logic flaw in the btm_sec_encrypt_change function of btm_sec.cc, a Bluetooth security component in the Android platform. The defect enables a downgrade attack against Bluetooth encryption, allowing a remote adjacent attacker to weaken the negotiated security level. Successful exploitation results in information disclosure over the Bluetooth link without requiring user interaction or elevated privileges. The issue is tracked under CWE-693: Protection Mechanism Failure and is addressed in the Android Security Bulletin September 2026.

Critical Impact
An attacker within Bluetooth range can downgrade link encryption to disclose sensitive data exchanged between paired devices.

Affected Products

Android platform (Bluetooth stack, btm_sec.cc)
Devices receiving the September 2026 Android security patch level
Downstream Android-based distributions incorporating the affected Fluoride Bluetooth stack

Discovery Timeline

2026-09-08 - CVE-2026-28627 published to the National Vulnerability Database
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-28627

Vulnerability Analysis

The vulnerability resides in btm_sec_encrypt_change, the routine that processes encryption change events issued by the Bluetooth controller. When the link layer reports a change in encryption state, this function evaluates whether the resulting security level satisfies the requirements of the active service. A logic error in that evaluation allows the function to accept a weakened or absent encryption state as valid.

Because the check is incorrect, an attacker who influences the encryption negotiation can cause the host stack to treat a downgraded link as adequately protected. Sensitive profile data, including attributes from services such as GATT, can then be observed by a nearby adversary. The flaw requires proximity but no user interaction and no additional execution privileges on the target device.

Root Cause

The defect is a protection mechanism failure classified as [CWE-693]. The affected code path fails to enforce the minimum required encryption key strength or algorithm after an encryption change event. Instead of rejecting the session or renegotiating, the stack continues processing traffic under weaker cryptographic guarantees than the service originally required.

Attack Vector

Exploitation occurs over the Bluetooth network. An attacker within radio range interferes with the pairing or encryption negotiation to force the peer into a lower security mode. When the controller signals the new state, the flawed logic in btm_sec_encrypt_change accepts it. The attacker then captures traffic protected only by the downgraded cipher and extracts information that should have remained confidential.

No verified exploit code is publicly available. Technical specifics are documented in the Android Security Bulletin September 2026.

Detection Methods for CVE-2026-28627

Indicators of Compromise

Unexpected Bluetooth encryption change events on paired devices, particularly transitions to weaker key sizes or unencrypted states
Repeated pairing or bonding attempts from unknown Bluetooth addresses in device logs
Anomalous GATT read activity on services that should require authenticated encryption

Detection Strategies

Review Android bugreport and logcat output for btm_sec messages indicating encryption state changes that do not match expected service requirements
Correlate Bluetooth HCI snoop logs with encryption key size negotiations to identify downgrades below the policy minimum
Monitor for Bluetooth Host Controller Interface events reporting encryption key sizes shorter than 16 bytes on links carrying sensitive profiles

Monitoring Recommendations

Enable Bluetooth HCI snoop logging on managed Android devices during investigations to capture negotiation traces
Track Android security patch level compliance across the fleet and flag devices missing the September 2026 patch
Alert on repeated proximity-based Bluetooth interactions in sensitive physical locations such as executive offices

How to Mitigate CVE-2026-28627

Immediate Actions Required

Apply the Android security patch level dated 2026-09-01 or later to all managed devices
Disable Bluetooth on devices that cannot receive the September 2026 patch when not actively in use
Restrict Bluetooth pairing in high-risk environments through mobile device management policies

Patch Information

Google addressed the flaw in the September 2026 Android Security Bulletin. Device manufacturers integrate the fix into their monthly security patch level. Administrators should verify that endpoints report a security patch level of 2026-09-01 or later. Full remediation details are published in the Android Security Bulletin September 2026.

Workarounds

Turn off Bluetooth discoverability and unpair unused devices to reduce exposure
Avoid pairing new Bluetooth peripherals in untrusted physical locations until patches are applied
Enforce a mobile device management baseline that requires the September 2026 Android patch level for access to corporate resources

bash

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later