Bluetooth has always been considered as an attractive target since it is present almost everywhere (TV, automotive charger, connected fridge) and especially on mobile devices as it runs as a privileged process with potential access to microphone, address book, etc. In september and october 2023, Android published security bulletins that fixed critical vulnerabilities in their Bluetooth stack (Fluoride) that could lead to remote code execution. The CVE-2023-40129 is an integer overflow vulnerability in the GATT protocol that does not require prior authentication with the target device. The vulnerability is quite challenging to exploit as the integer overflow leads to a 64 KB overflow that acts like a tsunami devastating every objects in its path leading to a crash of the Bluetooth daemon. Recently, at OffensiveCon 2025, the Android Red Team at Google behind the discovery of the bugs presented a PoC exploit for a sibling vulnerability targeting Pixel devices. However their exploit assumes the ASLR is disabled and the attacker is already paired with the target device. Attempting to exploit Fluoride looked like a fun challenge to the authors, who managed to exploit it without those assumptions and successfully got remote code execution. During this talk, the authors will present several Bluetooth features such as ERTM transmission mode and congestion that offer interesting primitives to shape the heap, preventing the 64 KB overflow from crashing the process. More precisely, they will detail their exploitation strategy for both Android native allocators: Scudo and Jemalloc. Finally, they will showcase a demo of the exploit to get remote code execution (interactive shell) over Bluetooth on Samsung and Xiaomi devices.