A vulnerability in the Android Bluetooth stack allows an unauthenticated attacker to access sensitive information due to a missing permission check in the AdapterService component.

This vulnerability is an information disclosure flaw located in the handleBondStateChanged method within AdapterService.java, where a missing permission check allows an unauthenticated remote attacker to access data.

The ability for an unauthenticated attacker to remotely access information without elevated privileges poses a significant risk to user privacy and data confidentiality. With a CVSS score of 7.5, this high severity flaw could result in the unauthorized exposure of sensitive device or user data, potentially leading to broader system compromise or loss of trust in mobile device security.

Immediate Action: Organizations should monitor the official Android Security Bulletin for the release of security patches and apply all available system updates to affected devices as soon as they are made available by manufacturers.

Proactive Monitoring: Security teams should monitor device logs for unexpected Bluetooth connection activity or unauthorized attempts to interface with the system Bluetooth service.

Compensating Controls: Since this is a core system component, users should minimize the exposure of Bluetooth services by disabling Bluetooth in high risk environments or when not in active use.

Public Exploit Available: No (exploit_available: false).

Given the high severity of this information disclosure vulnerability, it is imperative that administrators and users prioritize the application of security updates once provided by Google or device vendors. Failure to patch the affected versions leaves mobile assets exposed to potential remote data theft, and keeping firmware current remains the most effective strategy for mitigating this risk.