Android Bluetooth Module Cross-User Media Disclosure Vulnerability

A vulnerability in the Android Bluetooth module, specifically in the file transfer feature, allows for cross-user media disclosure. This issue arises from a confused deputy problem, where the system incorrectly manages user permissions, potentially leading to unauthorized access to media files belonging to other users. The vulnerability could be exploited without any additional privileges or user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized access to media files across different user accounts on the device.

Remediation

Users can update their devices to the April 2025 security patch level to address this vulnerability.