A critical use after free vulnerability in the Google Android Bluetooth stack permits an unauthenticated attacker to achieve remote code execution.

This is a memory corruption flaw (use after free) within the bta_hf_client_cb_init function of the Bluetooth module. The vulnerability allows a remote attacker to execute arbitrary code on the target device without requiring user interaction or elevated privileges.

The ability for a remote attacker to execute code on mobile devices poses a severe threat to data integrity, confidentiality, and device control. With a CVSS score of 8.0, this high-severity vulnerability could facilitate the compromise of sensitive corporate data, unauthorized surveillance, or the deployment of persistent malware on managed devices.

Immediate Action: Update affected Android devices to the latest security patch level provided by the vendor in the November 2025 security bulletin.

Proactive Monitoring: Monitor Bluetooth traffic logs for anomalous connection patterns or unexpected service requests that may indicate exploitation attempts.

Compensating Controls: Disable Bluetooth on devices when not in use to reduce the attack surface, and enforce mobile device management policies that restrict Bluetooth access in high-security environments.

Public Exploit Available: Yes, multiple public proofs-of-concept are available on GitHub.

Given the potential for remote code execution without user interaction, this vulnerability represents a significant risk to the mobile fleet. Security teams must prioritize the deployment of the November 2025 Android security updates across all supported versions, as the availability of public proof-of-concept code makes the window for remediation narrow.