Executive brief
A security vulnerability exists in the Android Contacts Provider, which manages the central repository of contact data on the device. An attacker could exploit this flaw to gain unauthorized access to the contacts database, potentially exposing sensitive personal information. This issue can be exploited without any special permissions or user interaction.
Technical details
A SQL injection vulnerability exists within the Android Contacts Provider component. The flaw is caused by improper neutralization of special elements used in SQL commands (CWE-89), allowing an attacker to bypass intended access controls. While the CVSS vector provided by the CNA suggests a network attack vector, the descriptive text identifies this as a local information disclosure issue. Successful exploitation allows an attacker to query the contacts database to extract sensitive information. The vulnerability is addressed in Android 17 with a security patch level of 2026-07-01 or later.
Affected products
- Google Android 17
Timeline
- 2026-06-16: advisory: Android 17 Security Release Notes published
- 2026-06-17: disclosed: CVE-2026-28576 published to NVD