Executive brief
Android's MediaProvider component contains a race condition in its file update logic that can allow an app to access the contents of files it should not have permission to read. An attacker with basic app privileges can exploit this without user interaction to view sensitive file contents, potentially exposing personal data, credentials, or other confidential information.
Technical details
A race condition vulnerability exists in the updateInternal method of MediaProvider.java, allowing information disclosure through improper file access control. The vulnerability is triggered during file update operations where a timing window permits unauthorized file content access. The attack requires local execution with standard app privileges and no user interaction. Successful exploitation can leak file contents to an unprivileged application. Security patches are available for Android 14, 15, 16, 16-qpr2, and 17 via the September 2026 security patch level (2026-09-05 or later).
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched