CVE-2026-0057: Android Contacts Provider Permission Check Bypass – Call Metadata Disclosure

Technical summary

CVE-2026-0057 stems from a missing permission check (CWE-862) in the Contacts Provider component. The vulnerability permits unauthorized disclosure of incoming call phone numbers and associated metadata through local access vectors. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects local-only attack surface, low complexity of exploitation, no privilege requirement, but requires user interaction in the execution chain. Confidentiality is limited in scope, with no integrity or availability impact.

Business impact

Organizations deploying Android devices face potential privacy leakage of call metadata, particularly relevant for enterprises handling sensitive communications. Third-party applications bundled or side-loaded could covertly harvest call records, risking compliance violations under GDPR, HIPAA, or similar frameworks depending on data classification. The impact is localized to individual devices but could affect user trust and regulatory standing in privacy-sensitive sectors.

Affected systems

Google Android is the confirmed affected vendor and product. The specific Android version range or affected components are not detailed in the source data; organizations should verify impacted versions through the Google Android security bulletin referenced in the vendor advisory.

Exploitability

Exploitation requires local device access, which is the primary limiting factor. No remote network path exists. An attacker must already be present on the device or trick a user into installing a malicious application. The missing permission check means the attacker does not need elevated privileges (PR:N), but user interaction (UI:R) during the attack execution phase is indicated by the CVSS vector, likely tied to triggering an incoming call scenario. Overall exploitability is straightforward for locally-positioned threats but not remotely viable.

Remediation

Patch availability depends on Android version and OEM delivery timelines. Google's security bulletin will specify affected Android versions and corresponding security patch levels. Device manufacturers and mobile carriers must push updates to users. Until patching, mitigations include restricting installation of untrusted applications, reviewing application permissions in Settings, and disabling side-loading if not operationally required.

Patch guidance

Check the Google Android Security & Privacy Year in Review bulletin or monthly security update for CVE-2026-0057 details, including affected API levels and patch version numbers. Apply the latest security patch available for your device's Android version and OEM variant. Verify patch deployment by confirming the security patch date in Settings > About Phone > Android Security Patch Level meets or exceeds the advisory date. OEMs may stagger rollout; follow your carrier or manufacturer's notification channels for deployment status.

Detection guidance

Monitor for suspicious application permissions related to phone call or contact access in device logs and Mobile Device Management (MDM) solutions. Audit installed third-party applications, particularly sideloaded APKs, for unnecessary phone or contact permissions. On enterprise devices, use MDM policies to restrict application installation sources and enforce permission policies. Monitor Android Security & Privacy reports for detailed forensic indicators if breach investigation is underway.

Why prioritize this

Although rated LOW severity (CVSS 3.3), this vulnerability merits attention for privacy-sensitive organizations. The missing permission check is a design-level flaw affecting core platform integrity around contact and call privacy. Even low-severity permission bypasses can compound with other vulnerabilities in lateral movement or persistent surveillance scenarios. Organizations handling regulated communications or managing BYOD programs should prioritize patching to maintain compliance posture and user trust.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects limited scope: local-only attack vector, no network exposure, and confidentiality impact confined to call metadata of a single device. No integrity or availability impact occurs. The presence of user interaction (UI:R) reduces the attack surface further. However, the complete absence of a permission check (CWE-862) is a structural security gap; the low score reflects the practical difficulty of remote exploitation, not the severity of the underlying design flaw.

Frequently asked questions