Executive brief
A security vulnerability in the Android messaging system could allow an unauthorized application to access sensitive user information. This occurs because the system fails to properly check for required permissions when accessing text message data. An attacker could exploit this to read private messages without any interaction from the user.
Technical details
A vulnerability in MmsSmsProvider.java within the Android System component arises from a missing authorization check (CWE-862). This flaw allows a local attacker to bypass permission requirements to retrieve sensitive data from the MmsSmsProvider. While the CNA provided a CVSS 4.0 score of 10.0 (Critical) with a network attack vector, the technical description specifies this leads to local information disclosure. No user interaction or elevated privileges are required for exploitation. The issue is addressed in Android 17 with a security patch level of 2026-07-01 or later.
Affected products
- Google Android 17
Timeline
- 2026-06-16: advisory: Android 17 Security Release Notes published
- 2026-06-17: disclosed: CVE published to NVD