CVE-2026-0097

Vulnerability

Multiple locations within Android's Bluetooth Low Energy (LE) implementation contain a logic error that allows for bypassing user interaction during device pairing. This vulnerability affects Android versions prior to the June 2026 security update.

Exploitation

An attacker in proximity to the target device can exploit this vulnerability by initiating a pairing process with an LE device. Due to the logic error, user interaction is not required to complete the pairing, enabling the attacker to proceed with privilege escalation.

Impact

Successful exploitation of this vulnerability can lead to a remote (proximal/adjacent) escalation of privilege. The attacker gains elevated privileges on the device without needing any additional execution privileges or requiring user interaction, potentially compromising the device's security and data.

Mitigation

This vulnerability is addressed in the Android Security Bulletin for June 2026 [1]. Users should ensure their devices are updated to the latest security patch level. No workarounds are available, and the end-of-life status for affected versions depends on the specific device manufacturer.