CVE-2026-0075: In multiple functions, there is a possible way to access the contacts database due to a SQL injection

Synopsis

SQL injection vulnerability in multiple functions of the Android contacts database provider allows a local attacker to access and manipulate contact data without requiring elevated privileges. The vulnerability is reachable locally, meaning an attacker with an existing low-privilege shell or app execution context on the device can exploit it without any user interaction. Successful exploitation enables local privilege escalation, giving the attacker full read, write, and availability impact on the affected component. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required.

• AuthenticationRequired

  Any low-privilege account or app execution context is sufficient; no admin or elevated privileges are needed before exploitation.

• Victim interactionNot required

  No user action is required; exploitation proceeds without any social engineering or user-triggered event.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors need to align for it to succeed.

Blast Radius

• Reads arbitrary records from the contacts database, exposing names, phone numbers, email addresses, and associated metadata stored on the device.
• Modifies or deletes persisted contact records, enabling data tampering or destruction of stored personal information.
• Triggers a local privilege escalation, potentially allowing the attacker to execute code or access resources beyond the contacts provider's normal permission boundary.