Hacker News Reader

> The vulnerabilities work by tricking the Bluetooth host state-machine into pairing with a fake keyboard without user-confirmation.

Is this possible to pair a keyboard device to Android without confirmation?

It's apparently a feature of ancient Bluetooth

If the vulnerability author is to be believed, yes.