CVE-2026-0075
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
An attacker may gain unauthorized access to contact data and escalate privileges on the system.
Recommendation
Install an operating system update that fixes the SQL injection vulnerability.
Other vulnerabilities in Android
See all- CVE-2016-0833High
Android allows users to cause a denial of service.
- CVE-2025-48595HighActively exploited
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.
- CVE-2025-48626Critical
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2016-3877Critical
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
- CVE-2026-49189High
Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.
- CVE-2026-24088High
A cryptographic issue while processing a specific partition allows unauthorized write access to load a customized bootloader.
- CVE-2026-28586Low
In multiple functions of AppOpsService.java, there is a missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed.
- CVE-2026-28581Medium
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, a logic error allows making an emergency call without proper privileges.
- CVE-2026-28580High
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.
- CVE-2026-28578Medium
In multiple functions of DevicePolicyManagerService.java, a desync from persistence due to improper input validation could lead to local denial of service.
Original NVD description (English source)
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.