CVE-2026-0075: Android SQL Injection in Contacts Database – Privilege Escalation Risk

Technical summary

Multiple functions in Google Android contain SQL injection flaws (CWE-89) in contact database query handling. The vulnerability exists in the contact database access layer, where unsanitized input is passed directly into SQL queries. By crafting malicious SQL statements, a local attacker can execute arbitrary database operations, bypassing normal access controls. The attack requires only local code execution capability—no additional privileges are needed, and exploitation can occur without user interaction or awareness.

Business impact

Organizations deploying Android devices face potential data breaches affecting sensitive contact information stored on employee and user devices. Loss of contact database confidentiality could expose customer lists, vendor relationships, and communications patterns. In BYOD environments, compromised contacts may propagate across personal and corporate networks. The privilege escalation component creates a pathway for attackers to gain deeper system control, potentially enabling installation of persistent malware or lateral movement within corporate infrastructure.

Affected systems

Google Android is affected across multiple versions and variants. Organizations should determine which Android versions are deployed in their environment by checking security bulletin details and vendor advisories. The vulnerability affects the contacts application framework component that handles database access. Users of any Android device may be impacted depending on their specific version and patch status.

Exploitability

The attack surface is local only—an attacker must first achieve code execution on the Android device. However, the absence of privilege requirements or user interaction significantly lowers the bar for exploitation once that foothold is established. Malicious apps, compromised system services, or physical access scenarios could serve as entry points. The CVSS 3.1 score of 5.9 (MEDIUM) reflects moderate severity due to local-only access combined with meaningful impact on confidentiality, integrity, and availability of contact data.

Remediation

Apply the latest security patch from Google for your Android version as soon as it becomes available. Contact database access functions should be updated to use parameterized queries or prepared statements that separate SQL logic from user-supplied data. Organizations should enforce device management policies requiring timely patching and consider restricting installation of apps from untrusted sources to reduce the risk of malicious code execution on managed devices.

Patch guidance

Monitor Google's Android Security & Privacy Year in Review and monthly security bulletins for patch releases addressing CVE-2026-0075. Patches will be distributed through Google Play System Update for devices enrolled in the Android security update program. Verify the specific patch version required for your deployed Android versions by consulting the official Google security advisory. Prioritize patching devices with high contact data sensitivity or elevated risk profiles. Test patches in a staging environment before broad deployment to ensure compatibility with your applications and workflows.

Detection guidance

Monitor for suspicious SQL query patterns in device logs and system audit trails that could indicate contact database exploitation attempts. Look for unexpected database access from privileged processes, unusual contact database file modifications, or anomalous contact list changes. On managed devices, enable enhanced logging for the contacts framework and review access logs for queries containing SQL keywords (SELECT, INSERT, UPDATE, DELETE) in unexpected contexts. Network monitoring may detect exfiltration of contact data to external servers following successful exploitation.

Why prioritize this

This vulnerability merits prompt attention because it requires no special permissions or user interaction, making it a realistic threat in scenarios where malicious code already executes locally—such as malware, compromised apps, or physical access. The direct impact on sensitive contact data and the privilege escalation pathway create meaningful business risk. Although local-only access somewhat limits exposure compared to remote flaws, the ease of exploitation once code execution is achieved and the sensitivity of contacts data justify treatment as a medium-priority patch target across managed Android deployments.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM) reflects three key factors: (1) local attack vector only, limiting but not eliminating practical risk; (2) low attack complexity with no special preconditions; (3) partial but meaningful impact on confidentiality (contact disclosure), integrity (contact modification), and availability (contact deletion). The score appropriately captures that the vulnerability poses real but contained risk—not critical, but requiring timely remediation in any environment where Android security posture is treated seriously.

Frequently asked questions