CVE-2026-28587: Android MmsSmsProvider Missing Permission Check—Information Disclosure

Technical summary

The vulnerability exists in the MmsSmsProvider content provider, which handles SMS and MMS messaging data on Android devices. An insufficiently protected query interface (CWE-862: Missing Authorization) permits local processes running with standard user privileges to access sensitive messaging information. The attack surface is limited to local execution contexts, but the lack of permission validation at the provider level means that any app with basic runtime permissions can trigger the disclosure without requiring device administrator access or system-level privileges.

Business impact

For enterprise environments managing Android devices—particularly in industries handling sensitive communications (healthcare, finance, legal)—this vulnerability poses a compliance and data protection risk. Unauthorized local access to SMS and MMS content could expose confidential business communications, two-factor authentication codes, or regulatory-sensitive messages. The local-only nature limits widespread attack scenarios, but the zero-interaction requirement means devices are vulnerable simply by having a malicious app installed.

Affected systems

Google Android operating system is affected. The vulnerability resides in the core MmsSmsProvider service, which is present across Android versions integrating this component. Specific affected Android versions and patches depend on vendor advisory details; organizations should verify their device inventory against Google's official security bulletin for CVE-2026-28587 to determine exposure scope.

Exploitability

Exploitation requires local code execution (an installed app) and does not require user interaction, system reboot, or additional privilege escalation. An attacker with basic app installation capability—either through social engineering, supply chain compromise, or enterprise app distribution—can immediately query the provider to extract SMS/MMS data. The CVSS 3.1 score of 5.5 (Medium) reflects the local-only attack vector and high confidentiality impact, but no integrity or availability impact.

Remediation

Apply security patches released by Google for CVE-2026-28587 to affected Android devices. Google's fix will likely add proper permission checks to the MmsSmsProvider to restrict access to authorized callers. Organizations should also evaluate app vetting processes to prevent malicious or poorly-secured applications from installation on managed devices, and consider implementing mobile app management (MAM) policies that restrict SMS/MMS access to trusted applications.

Patch guidance

Check Google's official Android Security & Privacy Year in Review bulletin or vendor-specific security advisories for patch availability and version information. Apply updates at the device or ROM level as applicable. Verify patching against your device management platform's compatibility matrix before broad rollout. If immediate patching is not feasible, mitigate by limiting installation of third-party applications and enforcing strict app permission reviews on managed Android devices.

Detection guidance

Monitor for unusual access patterns to SMS and MMS content through app permission audit logs or mobile device management (MDM) dashboards. Correlate denied content provider queries with app installation timelines if detection tools support provider-level access logging. On a broader scale, mobile threat defense (MTD) solutions can flag apps attempting unauthorized content provider access. Network-level detection is limited since the vulnerability operates entirely on-device.

Why prioritize this

Although rated Medium severity, this vulnerability should receive prompt attention in mobile-first organizations or enterprises with strict data protection policies. The zero-interaction exploitation path and inherent sensitivity of SMS/MMS data (especially for 2FA and confidential communications) justify treating this as moderately high priority. Prioritize patching for devices in regulated industries (healthcare, finance) or those handling executive/legal communications.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local-only attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and high confidentiality impact (C:H). The lack of integrity or availability impact prevents a higher score. However, the practical risk in an enterprise context is elevated by the prevalence of Android, reliance on SMS for authentication, and ease of app-based exploitation.

Frequently asked questions