Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2026-28576 EUVD-2026-37573GHSA-ph86-9mcx-3p6r

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information di…

Published Jun 17, 2026 · Updated Jun 17, 2026 · Assigned by google_android

Vendor: Android Product: Android Platform: Android

Description

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

VendorProductAffectedFixed
Android Android 17 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • mobilehackinglab/CVE-2026-28576-poc ★ 45 · Sep 7, 2026

    SQL injection vulnerability in Android 17 (AOSP)

  • Aayushbankar/cve-2026-28576 ★ 0 · Sep 22, 2026

    CVE-2026-28576 (GHSA-ph86-9mcx-3p6r) — Android Contacts Provider SQL Injection via targetSdk-gated ENFORCE_STRICT_SQL_CHECKS. Zero-permission boolean-oracle PoC + Red Team app with consent-gated dash…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References