A security researcher from Technische Universität Darmstadt
revealed a serious Android Bluetooth vulnerability in his blog post:
„A remote attacker within proximity can silently execute arbitrary code with the privileges of the Bluetooth daemon as long as Bluetooth is enabled. No user interaction is required and only the Bluetooth MAC address of the target devices has to be known.“
The bug affected Android 8.0 to 9.0. An attacker could exploit it to steal user data or spread malware. On Android 10, exploiting this vulnerability lead to the crashing of the Bluetooth daemon.
Google patched the flaw with its February updates.