important · Bluetooth — Pairing
A nearby Bluetooth peer can make Android skip pairing without user consent.
Affects
Android's system Bluetooth service on phones, tablets and other Android devices
A logic error in AdapterService.handleBondStateChanged lets a bond-state transition bypass pairing consent and produce remote privilege escalation without interaction.
Detail and 2 sources
Radio reachability is required, but the initiating state and precise transport are not public. The September 5 patch level addresses the affected Android families.