CVE-2026-0050: Bluetooth Module Vulnerability Leading to Sensitive Information Disclosure
Summary
CVE-2026-0050: In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. Affects platform/packages/modules/Bluetooth across 4 version ranges.
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth module in the Android ecosystem facilitates wireless communication between devices. It allows for various functionalities such as file transfer, audio streaming, and device pairing. However, this module has been identified to have a vulnerability that could lead to unauthorized access to sensitive information, compromising user privacy and security.
Vulnerability Detail
In the AdapterService.java file, the handleBondStateChanged function has a permissions bypass issue that allows local information disclosure without requiring additional execution privileges. This vulnerability can be exploited without user interaction, potentially exposing sensitive data to unauthorized users.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that sensitive information is not exposed through the Bluetooth module until the patch is applied. Limit the permissions granted to the Bluetooth module and monitor access to sensitive data.
Conclusion
The CVE-2026-0050 vulnerability in the Android Bluetooth module poses a significant risk of sensitive information disclosure. It is crucial to apply the available patches to mitigate this risk and ensure user data remains secure.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
CVE-2026-0050 is a vulnerability in the Android Bluetooth module that allows for sensitive information disclosure due to a permissions bypass.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The vulnerability could lead to unauthorized access to sensitive information, compromising user privacy and security without requiring user interaction.
Yes, a patch is available. Update the Bluetooth module to the fixed version released on 2026-06-01.
If you cannot apply the patch immediately, limit the permissions of the Bluetooth module and monitor access to sensitive data as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
