Executive brief
Android's MediaProvider component manages access to photos, videos, and other media files on a device. A permissions bypass vulnerability in the getQueryBuilderInternal function allows an attacker to retrieve sensitive location metadata (such as GPS coordinates) embedded in photos without requiring the location permission. This could expose users' location history and movement patterns without their knowledge or consent.
Technical details
The vulnerability is an authorization bypass in MediaProvider's getQueryBuilderInternal method (MediaProvider.java) that fails to properly enforce location-related permissions when querying media metadata. An attacker with local device access can bypass the permissions check to extract EXIF location data from images without holding the required location permission. No additional execution privileges or user interaction is required for exploitation. The issue affects multiple Android versions (14 through 17) and is addressed in the September 2026 security patch level (2026-09-05 or later).
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched