CVE-2026-0097: In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error

Synopsis

This is an authentication bypass vulnerability in Google Android (versions 14 through 16-qpr2) rooted in a logic error in the Bluetooth Low Energy (LE) pairing flow. An attacker on the same local network, LAN, or within Bluetooth radio range can exploit this without any user interaction, using only a low-privilege account. Successful exploitation allows the attacker to gain escalated privileges on the targeted Android device, with full access to confidential data, the ability to modify system state, and potential to disrupt device operation. No fix version has been published upstream; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be within adjacent-network range, such as Bluetooth radio proximity, the same LAN segment, or a shared VPN, to reach the vulnerable pairing interface.

• AuthenticationRequired

  A low-privilege account or equivalent Bluetooth client context is required, though no elevated or administrative privileges are needed to launch the exploit.

• Victim interactionNot required

  No action from the device owner or any other user is required; the pairing bypass is fully attacker-driven.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• Reads sensitive data stored on the device, including credentials, messages, and application data (Confidentiality: High).
• Modifies system settings, application data, or device configuration without the owner's consent (Integrity: High).
• Crashes or disrupts services running on the affected Android device (Availability: High).
• Achieves privilege escalation on the device, potentially gaining capabilities beyond the initial Bluetooth client context.