CVE-2025-36911
📋 TL;DR
This vulnerability in key-based pairing allows attackers within proximity to intercept and access users' conversations and location data without requiring authentication or user interaction. It affects Android devices using vulnerable pairing implementations, potentially exposing sensitive personal communications and tracking information.
💻 Affected Systems
- Android devices with vulnerable key-based pairing implementation
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all conversations and real-time location tracking of affected users, enabling surveillance, blackmail, or physical security threats.
Likely Case
Interception of nearby users' conversations and periodic location data exposure, potentially revealing sensitive personal or business information.
If Mitigated
Limited exposure if devices are updated or pairing is disabled, though proximity-based attacks remain possible against unpatched systems.
🎯 Exploit Status
Attack requires proximity to target device but no technical barriers beyond being within range. No user interaction needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Bulletin 2026-01-01 or later
Vendor Advisory: https://source.android.com/docs/security/bulletin/pixel/2026/2026-01-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install available security updates. 3. Restart device after installation completes.
🔧 Temporary Workarounds
Disable Bluetooth and Nearby Share
androidTurn off Bluetooth and Nearby Share features to prevent pairing attacks
adb shell settings put global bluetooth_on 0
adb shell pm disable-user --user 0 com.google.android.gms.nearby.sharing
Enable Airplane Mode
androidDisable all wireless communications when in sensitive environments
adb shell settings put global airplane_mode_on 1
adb shell am broadcast -a android.intent.action.AIRPLANE_MODE --ez state true
🧯 If You Can't Patch
- Physically isolate devices in Faraday cages or shielded rooms when handling sensitive conversations
- Implement strict physical security controls to prevent unauthorized proximity access to devices
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If before January 2026, likely vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows '2026-01-01' or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Unexpected pairing requests
- Multiple failed pairing attempts from unknown devices
- Unusual Bluetooth/Nearby activity patterns
Network Indicators:
- Bluetooth traffic spikes
- Unusual device discovery patterns
- Pairing requests from unexpected MAC addresses
SIEM Query:
source="android_logs" AND (event="bluetooth_pairing" OR event="nearby_connection") AND result="success" AND device_name="unknown"