Missing RECEIVE_SMS permission in AOSP Bluetooth app

2021-07-0100:00:00

Google

osv.dev

aosp

bluetooth

permission check

sms disclosure

information disclosure

local

exploitation

software

EPSS

Percentile

5.1%

JSON

In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.