{"id":"CVE-2026-28623","title":"In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check","summary":"In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges n…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-862"],"vendor":"google","product":"android","affected":["android = 16.0","android = 17.0"],"published":"2026-09-08","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:07:49.123","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28623","references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-09-01","label":"security@android.com"}],"tags":["nvd","cve.org"],"epss":0.00065,"epssPercentile":0.00017,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T17:07:21.506216Z"},"ingestedAt":"2026-09-08T19:08:49.642Z","slug":"CVE-2026-28623","body":"## Overview\n\nIn writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `android = 16.0`\n- `android = 17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201541,"id":"CVE-2026-28623","ts":1789399510960,"field":"cvss","old":null,"new":"3.3"},{"seq":201540,"id":"CVE-2026-28623","ts":1789399510960,"field":"severity","old":"none","new":"low"},{"seq":200275,"id":"CVE-2026-28623","ts":1789397086375,"field":"cvss","old":"3.3","new":null},{"seq":200274,"id":"CVE-2026-28623","ts":1789397086375,"field":"severity","old":"low","new":"none"},{"seq":198199,"id":"CVE-2026-28623","ts":1789391742134,"field":"cvss","old":null,"new":"3.3"},{"seq":198198,"id":"CVE-2026-28623","ts":1789391742134,"field":"severity","old":"none","new":"low"},{"seq":195992,"id":"CVE-2026-28623","ts":1789383399465,"field":"cvss","old":"3.3","new":null},{"seq":195991,"id":"CVE-2026-28623","ts":1789383399465,"field":"severity","old":"low","new":"none"},{"seq":194921,"id":"CVE-2026-28623","ts":1789380300484,"field":"cvss","old":null,"new":"3.3"},{"seq":194920,"id":"CVE-2026-28623","ts":1789380300484,"field":"severity","old":"none","new":"low"},{"seq":193708,"id":"CVE-2026-28623","ts":1789378268999,"field":"cvss","old":"3.3","new":null},{"seq":193707,"id":"CVE-2026-28623","ts":1789378268999,"field":"severity","old":"low","new":"none"},{"seq":192495,"id":"CVE-2026-28623","ts":1789376233379,"field":"cvss","old":null,"new":"3.3"},{"seq":192494,"id":"CVE-2026-28623","ts":1789376233379,"field":"severity","old":"none","new":"low"},{"seq":191282,"id":"CVE-2026-28623","ts":1789373126688,"field":"cvss","old":"3.3","new":null},{"seq":191281,"id":"CVE-2026-28623","ts":1789373126688,"field":"severity","old":"low","new":"none"},{"seq":190067,"id":"CVE-2026-28623","ts":1789369121120,"field":"cvss","old":null,"new":"3.3"},{"seq":190066,"id":"CVE-2026-28623","ts":1789369121120,"field":"severity","old":"none","new":"low"},{"seq":188854,"id":"CVE-2026-28623","ts":1789368038430,"field":"cvss","old":"3.3","new":null},{"seq":188853,"id":"CVE-2026-28623","ts":1789368038430,"field":"severity","old":"low","new":"none"},{"seq":187637,"id":"CVE-2026-28623","ts":1789364996587,"field":"cvss","old":null,"new":"3.3"},{"seq":187636,"id":"CVE-2026-28623","ts":1789364996587,"field":"severity","old":"none","new":"low"},{"seq":186424,"id":"CVE-2026-28623","ts":1789363002464,"field":"cvss","old":"3.3","new":null},{"seq":186423,"id":"CVE-2026-28623","ts":1789363002464,"field":"severity","old":"low","new":"none"},{"seq":185210,"id":"CVE-2026-28623","ts":1789360969780,"field":"cvss","old":null,"new":"3.3"},{"seq":185209,"id":"CVE-2026-28623","ts":1789360969780,"field":"severity","old":"none","new":"low"},{"seq":183997,"id":"CVE-2026-28623","ts":1789357943485,"field":"cvss","old":"3.3","new":null},{"seq":183996,"id":"CVE-2026-28623","ts":1789357943485,"field":"severity","old":"low","new":"none"},{"seq":182249,"id":"CVE-2026-28623","ts":1789354097969,"field":"cvss","old":null,"new":"3.3"},{"seq":182248,"id":"CVE-2026-28623","ts":1789354097969,"field":"severity","old":"none","new":"low"},{"seq":181042,"id":"CVE-2026-28623","ts":1789352943463,"field":"cvss","old":"3.3","new":null},{"seq":181041,"id":"CVE-2026-28623","ts":1789352943463,"field":"severity","old":"low","new":"none"},{"seq":179835,"id":"CVE-2026-28623","ts":1789350001165,"field":"cvss","old":null,"new":"3.3"},{"seq":179834,"id":"CVE-2026-28623","ts":1789350001165,"field":"severity","old":"none","new":"low"},{"seq":178628,"id":"CVE-2026-28623","ts":1789347814400,"field":"cvss","old":"3.3","new":null},{"seq":178627,"id":"CVE-2026-28623","ts":1789347814400,"field":"severity","old":"low","new":"none"},{"seq":177421,"id":"CVE-2026-28623","ts":1789346181781,"field":"cvss","old":null,"new":"3.3"},{"seq":177420,"id":"CVE-2026-28623","ts":1789346181781,"field":"severity","old":"none","new":"low"},{"seq":176214,"id":"CVE-2026-28623","ts":1789342752084,"field":"cvss","old":"3.3","new":null},{"seq":176213,"id":"CVE-2026-28623","ts":1789342752084,"field":"severity","old":"low","new":"none"},{"seq":175998,"id":"CVE-2026-28623","ts":1789342358588,"field":"cvss","old":null,"new":"3.3"},{"seq":175997,"id":"CVE-2026-28623","ts":1789342358588,"field":"severity","old":"none","new":"low"},{"seq":175538,"id":"CVE-2026-28623","ts":1789338390087,"field":"cvss","old":"3.3","new":null},{"seq":175537,"id":"CVE-2026-28623","ts":1789338390087,"field":"severity","old":"low","new":"none"},{"seq":174333,"id":"CVE-2026-28623","ts":1789334604833,"field":"cvss","old":null,"new":"3.3"},{"seq":174332,"id":"CVE-2026-28623","ts":1789334604833,"field":"severity","old":"none","new":"low"},{"seq":173128,"id":"CVE-2026-28623","ts":1789333197506,"field":"cvss","old":"3.3","new":null},{"seq":173127,"id":"CVE-2026-28623","ts":1789333197506,"field":"severity","old":"low","new":"none"},{"seq":171942,"id":"CVE-2026-28623","ts":1789330884550,"field":"cvss","old":null,"new":"3.3"},{"seq":171941,"id":"CVE-2026-28623","ts":1789330884550,"field":"severity","old":"none","new":"low"}]}