CVE-2026-28576: SQL Injection
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until a patch is available and deployed, restrict local access to the contacts database/Contacts Provider: remove or limit contact-access permissions from untrusted apps, enforce stricter app-installation policies, and apply OS-level sandboxing or access controls to minimize which apps can query the provider.
- Operational
Remediate the SQL injection in the Contacts Provider: validate and sanitize all inputs used in queries, convert vulnerable queries to use parameterized/prepared statements, fix the code path(s) that allow injection, and produce and deploy a patched build to affected devices.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28576?
CVE-2026-28576 has a critical severity rating of 10 on the CVSS scale.
How do I fix CVE-2026-28576?
To fix CVE-2026-28576, ensure that your Android device is updated to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-28576?
CVE-2026-28576 is classified as an SQL injection vulnerability.
What could be the consequence of exploiting CVE-2026-28576?
Exploitation of CVE-2026-28576 could lead to local information disclosure of the contacts database.
Is user interaction required to exploit CVE-2026-28576?
No, user interaction is not needed for the exploitation of CVE-2026-28576.