Do Son 
TL;DR
A maximum-severity SQL injection flaw sits in the Android Contacts Provider. Tracked as CVE-2026-28576 with a CVSS score of 10, it lets a permission-less app read every contact. A public proof-of-concept exploit is available.
- CVE: CVE-2026-28576
- CVSS: 10 (Critical · CVSSv4)
- Product: Android
- Affected: 17
- Status: No confirmed exploitation yet
- EPSS: 0.1% (30-day)
- Action: See vendor advisory
Track every Google CVE the moment it's exploited.
Get free email alertsWhy this Android SQL injection matters
Contacts hold names, phone numbers, emails, and private notes. This Android SQL injection exposes all of it. An app needs no permissions and no READ_CONTACTS grant.
Researchers at Mobile Hacking Lab documented the bug. Their write-up rates it CVSS 10, the top of the scale. The flaw turns a single-contact grant into a full database dump.
How the attack works
Android 17 added a system contact picker, much like the photo picker. A user picks one contact, and the system grants read access to that single row. The grant layer is meant to decide which rows an app can touch.
CVE-2026-28576 breaks that boundary one level down, inside the provider’s SQL. Android 17 added strict SQL checks, but only for apps targeting a newer SDK. Apps on an older target skip the hardening entirely.
On that legacy path, the provider accepts a crafted selection clause. A balanced subquery then reads the raw contacts table. Acting as a boolean oracle, the app dumps the whole database one character at a time.
Affected versions
The bug affects Android 17 with a security patch level before 2026-07-01. Mobile Hacking Lab confirmed the dump on a device holding three victim contacts. It read every name, phone, and email without READ_CONTACTS.
Exploitation status
A public proof-of-concept exploit exists on GitHub. It includes source, a prebuilt APK, and reproduction steps. However, no in-the-wild exploitation has been confirmed.
Patch and mitigation steps
Update to a build with the July 2026 patch level or later. The fix enables the strict SQL checks for every caller. Read the full technical breakdown in the Mobile Hacking Lab blog. The team also published the CVE-2026-28576 proof-of-concept on GitHub. Since details and code are now public, patching quickly is the safest move.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
