CVE-2026-28576: Android Contacts Provider SQL Injection (CVSS 5.5)

Technical summary

CVE-2026-28576 is a SQL injection vulnerability (CWE-89) in the Contacts Provider component of Google Android. The flaw permits local code execution context to craft malicious SQL queries that bypass intended access controls on the contacts database. An attacker with local access and basic app permissions (PR:L) can inject SQL commands to retrieve sensitive contact records. The attack requires no elevated privileges (no root), no user interaction (UI:N), and operates within a single security context (S:U), resulting in a CVSS v3.1 score of 5.5 (MEDIUM severity). The primary impact is confidentiality breach (C:H); integrity and availability are not affected (I:N, A:N).

Business impact

Contact databases often contain business-critical relationship data, customer lists, employee directories, and integrated identifiers used for authentication and account recovery. A SQL injection breach of contacts exposes personally identifiable information (PII) and can facilitate targeted social engineering, identity theft, and unauthorized contact harvesting. For organizations managing device fleets or regulated environments, uncontrolled contact exfiltration may trigger data breach notification obligations and regulatory penalties. The low barrier to exploitation (local + basic permissions) means any installed app with modest permissions can trigger the leak.

Affected systems

Google Android devices running versions that include the vulnerable Contacts Provider implementation are in scope. The exact affected versions are not enumerated in the published advisory; verify the vendor's security bulletin for specific Android versions and any OEM-specific implementations. This affects all Android form factors (phones, tablets, wearables) that bundle the Contacts Provider component.

Exploitability

Exploitation is straightforward from a technical standpoint. Any local app with basic permissions can trigger the SQL injection if the Contacts Provider accepts untrusted input in query parameters or filters without proper sanitization. The attack requires no special tools, no user interaction, and no privilege escalation—making it accessible to malicious apps or compromised third-party libraries. However, real-world impact depends on whether the Contacts Provider is actually exposed to local process input in a way that allows injection; verify Android's query interface documentation and the patch details to confirm the attack surface.

Remediation

Apply the security patch released by Google for your affected Android version. Patch details and timelines should be confirmed via Google's Android Security & Privacy Year in Review or the specific security bulletin. Device manufacturers and carriers should prioritize rollout to minimize the window of exposure. Organizations managing Android devices should enforce patch deployment through mobile device management (MDM) solutions and track compliance metrics.

Patch guidance

Check Google's official Android security bulletins (typically published monthly) for the specific version addressing CVE-2026-28576. Patches are generally delivered via monthly security updates to Pixel devices and AOSP; OEMs and carriers may have different timelines. Apply patches through Settings > System > System Update or your device manufacturer's update mechanism. For enterprise deployments, use MDM to deploy updates and verify successful installation across your fleet. Test patches in a non-production environment if contacts synchronization or third-party contact apps are mission-critical.

Detection guidance

Monitor app behavior and permissions: flag any apps requesting READ_CONTACTS or WRITE_CONTACTS permissions that lack clear business purpose. Use static analysis (APK scanning) to detect known-malicious contact-exfiltration patterns. Log and alert on anomalous queries to the Contacts Provider API—particularly queries with UNION, LIKE wildcards, or unusual WHERE clauses if your monitoring tools support that visibility. At the OS level, verify that Contacts Provider is up to date and that no third-party contacts apps are patching or replacing the system provider with a vulnerable version. Android's normal SELinux and permission boundaries should limit the practical blast radius if properly configured.

Why prioritize this

Although the CVSS score is MEDIUM (5.5), the vulnerability warrants prompt attention because: (1) it affects a widely-used system component (Contacts Provider) on billions of Android devices; (2) exploitation requires minimal prerequisites (local access + basic app permissions are common); (3) contact data is sensitive PII with high value to attackers; (4) the fix is straightforward patching with no expected user workflow disruption. Prioritize based on your device fleet composition and the sensitivity of contact data in your organization. Critical for organizations storing regulated contact information or managing high-value customer/partner lists.

Risk score, explained

The CVSS v3.1 score of 5.5 reflects attack vector Local (not network-exploitable), low complexity, low privilege requirement, and no user interaction—favorable for attackers. However, the impact is limited to confidentiality (C:H); integrity and availability are unaffected. This places the vulnerability in the MEDIUM band. The score does not account for the widespread deployment of Android or the ubiquity of contact data; from a business risk perspective, organizations may rate this higher depending on contact data sensitivity and app security posture.

Frequently asked questions