Cross User Media Disclosure in Android Bluetooth Module

CVE-2024-49728

What is CVE-2024-49728?

A vulnerability exists in the Android Bluetooth module that allows for potential cross user media disclosure. Specifically, in the method generateFileInfo of BluetoothOppSendFileInfo.java, there is a flawed handling of user permissions, leading to possible exposure of local information without requiring additional execution privileges. Exploitation of this vulnerability can occur without user interaction, raising significant security concerns for users relying on Bluetooth services for file transfers. This issue underscores the need for robust security measures in Android's handling of user data.

References