A critical vulnerability in Google Android Wear allows for unauthenticated, zero-click information disclosure of sensitive device state data, warranting immediate attention.

The vulnerability resides in the checkReadPermission function within PermissionsManager.java, where a failure to validate permissions allows an unauthenticated attacker to bypass security controls. This flaw enables unauthorized access to sensitive device state information without requiring user interaction or elevated privileges.

The potential for unauthorized access to sensitive device telemetry and state data poses a severe risk to user privacy and enterprise security. Given the CVSS score of 10.0, this flaw is categorized as critical, as it facilitates complete compromise of device confidentiality and integrity. Organizations relying on Android Wear devices for sensitive operations may face significant reputational damage and data breach risks if this vulnerability is exploited.

Immediate Action: Review the official Google security bulletin at the provided reference link and apply the latest available updates for Android Wear as soon as they are released by the vendor.

Proactive Monitoring: Monitor system and application logs for unusual patterns in permission requests or unexpected access to device state management components.

Compensating Controls: Restrict device connectivity to trusted networks and ensure that security policies are enforced to limit the potential impact of unauthorized data exposure until patches are applied.

Public Exploit Available: Unknown

This vulnerability represents a critical security failure in the Android Wear permission model, allowing for silent information disclosure. Given the maximum CVSS severity, administrators should prioritize updating affected devices immediately upon the availability of vendor-supplied patches to mitigate the risk of unauthorized data access.