CVE-2026-28576-poc

CVE-2026-28576: SQL Injection in the Android Contacts Provider One picked contact, every contact: a targetSdk compat gate turns a single-contact picker grant into a full contacts database dump. Android 17 hardened the Contacts Provider against SQL injection with setStrictColumns / setStrictGramma...

CVE-2026-0075

CVE-2026-0075 ContactsProvider Research PoC A controlled-lab Android research prototype for evaluating the observable behavior associated with CVE-2026-0075 in ContactsProvider2. Overview CVE-2026-0075 is an Android local elevation-of-privilege issue in ContactsProvider2. The public advisory...

CVE-2020-0486

In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege to change contact data with no additional execution privileges needed. User interaction is not needed for...

CVE-2020-0486

In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege to change contact data with no additional execution privileges needed. User interaction is not needed for...

Design/Logic Flaw

In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege to change contact data with no additional execution privileges needed. User interaction is not needed for...

CVE-2020-0486

In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege to change contact data with no additional execution privileges needed. User interaction is not needed for...