Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Google Contacts Provider allows unauthorized data access

CVE-2026-0075 · published 5 months ago
Summary

The contacts component in Google’s platform can be tricked into running unintended database commands, letting a local user read or modify contact information without extra permissions. This can increase a user’s access rights on the device. Apply the latest updates from Google that fix the issue or restrict access to the contacts provider until patched.

What to do
  • Update google platform/packages/providers/contactsprovider to version 17-next:2026-06-01.
  • Update google platform/packages/providers/contactsprovider to version 15:2026-06-01.
  • Update google platform/packages/providers/contactsprovider to version 16:2026-06-01.
  • Update google platform/packages/providers/contactsprovider to version 16-qpr2:2026-06-01.
  • Update google platform/packages/providers/contactsprovider to version 14:2026-06-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/packages/providers/contactsprovider >= 17-next:0, < 17-next:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 14:0, < 14:2026-06-01
Fix: upgrade to 17-next:2026-06-01
– google android 14.0
15.0
16.0
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
Original advisory text
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges neede...
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published1 Jun 2026
Updated29 Sep 2026
First seen1 Jun 2026
Sources
CVE-2026-0075 · NVD
ASB-A-465133716 · OSV
Track software like this
Free during beta