CVE-2026-28576

critical · 10

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS

0.1%

EPSS (exploit prob.)

4th

EPSS percentile

2026-06-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
google	android	17.0

Check a specific version with /api/v1/cve/match.

References

https://source.android.com/docs/security/bulletin/android-17

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-28576