CVE-2026-0045: In bta_jv_rfcomm_connect of bta_jv_act

Synopsis

This is a privilege-escalation vulnerability in the Android Bluetooth stack, specifically in the RFCOMM connection handler (bta_jv_rfcomm_connect in bta_jv_act.cc). A logic error allows a local attacker to bypass the bonding check that normally enforces secure Bluetooth connections, without needing elevated privileges or user interaction. Successful exploitation gives the attacker full read, write, and execution control over the affected process. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  Exploitation completes without any action from another user on the system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors must be met.

Blast Radius

• The attacker reads any data accessible to the compromised Bluetooth service process, including paired device records and connection metadata.
• The attacker writes to or modifies data within the process context, including Bluetooth pairing state and connection configurations.
• The attacker gains code execution at the privilege level of the Bluetooth stack process, enabling further lateral movement on the device.
• All three impact dimensions (confidentiality, integrity, availability) are rated High, meaning the attacker achieves full effective control over the affected component.