CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
CVE-2026-28576 (CVSS 10): Android SQL Injection PoC Out
TL;DR A maximum-severity SQL injection flaw sits in the Android Contacts Provider. Tracked as CVE-2026-28576 with a CVSS score of 10, it lets a permission-less app read every contact. A public proof-of-concept exploit is available. Why this Android SQL injection matters Contacts hold names, phone numbers, emails, and private notes. This Android SQL injection exposes all of it. An app needs no permissions and no READ_CONTACTS grant.
securityonline.info
September 11, 2026 at 12:15 AM
CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel
Original text: "SQL Injection Still Exists, Even in Android: One Picked Contact, Every Contact (CVE-2026-28576)" — Mobile Hacking Lab. Code, tables and figures below are reproduced verbatim with attribution captions. #CVE #C
https://core-jmp.org/2026/09/cve-2026-28576-android-sql-injection-contacts/
https://core-jmp.org/2026/09/cve-2026-28576-android-sql-injection-contacts/
SQL Injection Still Exists in Android: One Picked Contact, Every Contact (CVE-2026-28576)
A critical SQL injection vulnerability in Android 17's ContactsProvider allows apps using the system contact picker to exfiltrate all contacts on a device without any permissions. Exploiting Android's targetSdk-gated security patches reveals how legacy API levels inherit pre-fix behavior.
core-jmp.org
September 9, 2026 at 10:41 AM
Original text: "SQL Injection Still Exists, Even in Android: One Picked Contact, Every Contact (CVE-2026-28576)" — Mobile Hacking Lab. Code, tables and figures below are reproduced verbatim with attribution captions. #CVE #C
https://core-jmp.org/2026/09/cve-2026-28576-android-sql-injection-contacts/
https://core-jmp.org/2026/09/cve-2026-28576-android-sql-injection-contacts/
A public PoC for CVE-2026-0075 shows an Android elevation of privilege in ContactsProvider2 that needs no user interaction.
#CVE20260075 #Android #ElevationOfPrivilege #ContactsProvider #SQLInjection #AndroidSecurity
#CVE20260075 #Android #ElevationOfPrivilege #ContactsProvider #SQLInjection #AndroidSecurity
CVE-2026-0075: PoC Discloses Android EoP With No User Interaction
TL;DR Google patched CVE-2026-0075, an Android elevation of privilege flaw in ContactsProvider2. The bug can expose the contacts database through SQL injection, with no user interaction required. A researcher has now published proof-of-concept code and root-cause details on GitHub. Android rates the issue High. Why It Matters Contacts data is sensitive. This CVE-2026-0075 flaw lets a local app reach that data without holding the usual permissions.
securityonline.info
August 19, 2026 at 1:27 PM
A public PoC for CVE-2026-0075 shows an Android elevation of privilege in ContactsProvider2 that needs no user interaction.
#CVE20260075 #Android #ElevationOfPrivilege #ContactsProvider #SQLInjection #AndroidSecurity
#CVE20260075 #Android #ElevationOfPrivilege #ContactsProvider #SQLInjection #AndroidSecurity