CVE- 2026-28576 is a maximum-severity SQL injection flaw found in Android’s Contacts Provider. The bug, identified by Mobile Hacking Lab, is rated CVSS 10 and permits a permission-less app to read the entire contacts database, including names, phone numbers, emails, and private notes, without requiring the READ_CONTACTS permission. A public proof-of-concept exploit exists, with sources and a prebuilt APK published on GitHub, though there is no confirmed in‑the‑wild exploitation at the time of the report.
The vulnerability stems from how the Contacts Provider handles certain selection clauses. On Android 17, a system contact picker grants read access to a single contact row, but the strict SQL checks added for newer SDK targets are not applied to older targets. In those legacy paths, a crafted selection clause can cause a balanced subquery to read the raw contacts table, effectively turning a narrow grant into a full database dump.
The bug has been shown to affect Android 17 devices with a security patch level before 2026-07-01, enabling the attacker to exfiltrate all stored contact data. At the time of publication, exploitation in the wild had not been confirmed, but a PoC exists and patches are publicly available. Mitigation advises updating to a build with the July 2026 patch level or later, which enforces the stricter SQL checks for all callers.