CVE-2026-28576: In Contacts Provider, there is a possible way to access the contacts database due to SQL injection

Synopsis

SQL injection in the Android Contacts Provider allows an attacker to interact with the contacts database without any authentication or user action. The vulnerability is reachable over the network and requires no privileges, meaning an attacker can send a crafted query directly to the exposed content provider. Successful exploitation gives the attacker full read access to stored contacts data, the ability to modify or delete records, and the ability to disrupt the availability of the contacts service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Google publishes a fix for Android 17.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network; an attacker must be able to send requests to the exposed Contacts Provider endpoint to deliver a malicious query.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the attacker can interact with the content provider anonymously.

• Victim interactionNot required

  The exploit completes without any action from a user on the affected device or system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• Reads the full contacts database, including names, phone numbers, email addresses, and any custom fields stored by applications using the provider.
• Modifies or deletes persisted contact records, corrupting data visible to every app that queries the provider.
• Crashes or degrades the Contacts Provider service, making contact lookup unavailable to dependent applications.
• The CVSS v4.0 vector records high impact on both the vulnerable system and downstream systems, meaning any service that consumes contacts data inherits the exposure.