Do Son 
TL;DR
Google patched CVE-2026-0075, an Android elevation of privilege flaw in ContactsProvider2. The bug can expose the contacts database through SQL injection, with no user interaction required. A researcher has now published proof-of-concept code and root-cause details on GitHub. Android rates the issue High.
- CVE: CVE-2026-0075
- CVSS: 7.8 (High · CVSSv3)
- Product: Google Android
- Affected: 16-qpr2, 16, 15, 14
- Impact: In multiple functions, there is a possible way to access the contacts database due to a SQL...
- Status: No confirmed exploitation yet
- EPSS: 0.1% (30-day)
- Action: See vendor advisory
Why It Matters
Contacts data is sensitive. This CVE-2026-0075 flaw lets a local app reach that data without holding the usual permissions. Crucially, exploitation needs no user interaction and no extra execution privileges.
Google fixed the bug in the June 2026 Android Security Bulletin. The same month also carried an actively exploited zero-day, though that was a separate Framework flaw. As a result, defenders had strong reason to patch quickly.
How the Attack Works
ContactsProvider2 handles contact data for Android apps. The vulnerability lives in how it processes certain queries. A crafted input can reach a SQL injection path inside the provider.
According to the research, the flaw acts as an error side-channel. ContactsProvider2 returned JSON-related SQLite exception messages to callers that lacked READ_CONTACTS. Consequently, an app with no contacts permission could infer database content from those errors.
The public proof-of-concept for CVE-2026-0075 is a research app that declares no contacts permissions. It helps testers compare behavior on patched and unpatched builds. Importantly, the researcher stresses it is for controlled labs, not production devices.
Affected Versions
The June 2026 Android Security Bulletin lists Android 14, 15, 16, and 16-qpr2 as affected AOSP versions. Google marks the severity as High.
Devices at the 2026-06-05 patch level or later include the fix. The AOSP change strips JSON-related exception messages for callers without READ_CONTACTS.
Patch and Mitigation Steps
First, update affected devices to the 2026-06-05 security patch level or newer. Check Settings for the current patch level and apply pending updates.
Vendor rollout timing varies by device and model. Therefore, users on older or slower-updating hardware should confirm their patch level directly. No in-the-wild exploitation of CVE-2026-0075 has been confirmed. Even so, the public PoC makes prompt patching the safer choice.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
