CVE-2026-28576 Details
Description
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
A SQL injection vulnerability has been identified in the Contacts Provider component of Android. This issue allows unauthorized access to the contacts database, potentially leading to local information disclosure. The vulnerability does not require any additional execution privileges or user interaction for exploitation.
Users can update their devices to Android 17 with a security patch level of 2026-07-01 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://source.android.com/docs/security/bulletin/android-17 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| google android | 17.0 - |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | New CVE Received | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |