Skip to content
OpenAdvisories
Unscored CVE-2021-1037 EUVD-2021-6504GHSA-fc93-89fq-8669

The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to li…

Published Jan 14, 2022 · Updated Aug 3, 2024 · Assigned by google_android

Description

The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to listen for it. This lets apps keep track of what devices are paired without requesting BLUETOOTH permissions.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-162951906

Affected products

VendorProductAffectedFixed
— Android Android-10 Android-11 Android-12 Android-9 —

References