{"id":"ASB-A-465133716", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-26T15:22:10.377767615Z", "aliases":["CVE-2026-0075", "A-465133716"], "details":"In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/providers/ContactsProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/6044ca5db93f9e8e5ef59dd94b97b7039a3e2c7d"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["174109802260110429025126535300258579448", "61805258838576181967175519828738291817", "99276373545876684026409368586235741696", "104117919953874387096920762805432908424", "44905717540477058735536096648194851899", "253775033116321958565428467414583301252", "63815629847303037668932222887346538451", "2670960310369602436491354670582779299", "293136208918172338730680569222876507201", "310937112749657920413302397518481637823", "104128373343281123032534124348768326166", "18387634154170669671388436057341323992", "140941994007822631418484391586177374107", "284782678103595873297176302575901559363", "104128373343281123032534124348768326166", "150562261012211004977834823951934166130", "149883628856771879461821604510907118754", "177390120815022758096083881275067438441", "104128373343281123032534124348768326166", "289152166078996194694446288779704684673", "130185578066441930697048196985935568995", "295345443212088835607338847109546060955", "211382881051308093025017484833165007430", "320877382351371652279712052870875667691", "104128373343281123032534124348768326166", "329079589182380244815330219273344792087", "299010617626844963994754332333966742317", "62878674153116585571822223835893772099", "69802657251485483034272610549141850711", "247367063144086811135727449968378200560"], "threshold":0.9}, "id":"ASB-A-465133716-0b7487f7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/6044ca5db93f9e8e5ef59dd94b97b7039a3e2c7d", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java"}}, {"deprecated":false, "digest":{"function_hash":"234885050796259996493313331127043670853", "length":949}, "id":"ASB-A-465133716-4dc70c98", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/6044ca5db93f9e8e5ef59dd94b97b7039a3e2c7d", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"delete"}}, {"deprecated":false, "digest":{"function_hash":"273119325761839804296270056522454957983", "length":668}, "id":"ASB-A-465133716-d97e5c18", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/6044ca5db93f9e8e5ef59dd94b97b7039a3e2c7d", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"query"}}, {"deprecated":false, "digest":{"function_hash":"94411036843228921880291415215601056123", "length":1285}, "id":"ASB-A-465133716-dacac33e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/6044ca5db93f9e8e5ef59dd94b97b7039a3e2c7d", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"insert"}}, {"deprecated":false, "digest":{"function_hash":"275820184881413845175302596607676766459", "length":1033}, "id":"ASB-A-465133716-ebce673c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/6044ca5db93f9e8e5ef59dd94b97b7039a3e2c7d", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"update"}}]}}, {"package":{"name":"platform/packages/providers/ContactsProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/45596d704731173036c8cb3f4470b76b9869a930"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"275820184881413845175302596607676766459", "length":1033}, "id":"ASB-A-465133716-0a24611f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/45596d704731173036c8cb3f4470b76b9869a930", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"update"}}, {"deprecated":false, "digest":{"function_hash":"273119325761839804296270056522454957983", "length":668}, "id":"ASB-A-465133716-202bf808", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/45596d704731173036c8cb3f4470b76b9869a930", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"query"}}, {"deprecated":false, "digest":{"line_hashes":["174109802260110429025126535300258579448", "61805258838576181967175519828738291817", "99276373545876684026409368586235741696", "104117919953874387096920762805432908424", "44905717540477058735536096648194851899", "253775033116321958565428467414583301252", "63815629847303037668932222887346538451", "2670960310369602436491354670582779299", "293136208918172338730680569222876507201", "310937112749657920413302397518481637823", "104128373343281123032534124348768326166", "18387634154170669671388436057341323992", "140941994007822631418484391586177374107", "284782678103595873297176302575901559363", "104128373343281123032534124348768326166", "150562261012211004977834823951934166130", "149883628856771879461821604510907118754", "177390120815022758096083881275067438441", "104128373343281123032534124348768326166", "289152166078996194694446288779704684673", "130185578066441930697048196985935568995", "295345443212088835607338847109546060955", "211382881051308093025017484833165007430", "320877382351371652279712052870875667691", "104128373343281123032534124348768326166", "329079589182380244815330219273344792087", "299010617626844963994754332333966742317", "62878674153116585571822223835893772099", "69802657251485483034272610549141850711", "247367063144086811135727449968378200560"], "threshold":0.9}, "id":"ASB-A-465133716-3c178563", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/45596d704731173036c8cb3f4470b76b9869a930", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java"}}, {"deprecated":false, "digest":{"function_hash":"273975568050708746596117449317992794879", "length":990}, "id":"ASB-A-465133716-c043e38e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/45596d704731173036c8cb3f4470b76b9869a930", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"insert"}}, {"deprecated":false, "digest":{"function_hash":"234885050796259996493313331127043670853", "length":949}, "id":"ASB-A-465133716-f246b9c8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/45596d704731173036c8cb3f4470b76b9869a930", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"delete"}}]}}, {"package":{"name":"platform/packages/providers/ContactsProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/0570ed10b63de586efbe4bd3ac6c59ca4f4d9bbb"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"234885050796259996493313331127043670853", "length":949}, "id":"ASB-A-465133716-1f77c3d8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/0570ed10b63de586efbe4bd3ac6c59ca4f4d9bbb", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"delete"}}, {"deprecated":false, "digest":{"function_hash":"275820184881413845175302596607676766459", "length":1033}, "id":"ASB-A-465133716-2162f57d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/0570ed10b63de586efbe4bd3ac6c59ca4f4d9bbb", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"update"}}, {"deprecated":false, "digest":{"line_hashes":["174109802260110429025126535300258579448", "61805258838576181967175519828738291817", "99276373545876684026409368586235741696", "104117919953874387096920762805432908424", "44905717540477058735536096648194851899", "253775033116321958565428467414583301252", "63815629847303037668932222887346538451", "2670960310369602436491354670582779299", "293136208918172338730680569222876507201", "310937112749657920413302397518481637823", "104128373343281123032534124348768326166", "18387634154170669671388436057341323992", "140941994007822631418484391586177374107", "284782678103595873297176302575901559363", "104128373343281123032534124348768326166", "150562261012211004977834823951934166130", "149883628856771879461821604510907118754", "177390120815022758096083881275067438441", "104128373343281123032534124348768326166", "289152166078996194694446288779704684673", "130185578066441930697048196985935568995", "295345443212088835607338847109546060955", "211382881051308093025017484833165007430", "320877382351371652279712052870875667691", "104128373343281123032534124348768326166", "329079589182380244815330219273344792087", "299010617626844963994754332333966742317", "62878674153116585571822223835893772099", "69802657251485483034272610549141850711", "247367063144086811135727449968378200560"], "threshold":0.9}, "id":"ASB-A-465133716-2c7b0971", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/0570ed10b63de586efbe4bd3ac6c59ca4f4d9bbb", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java"}}, {"deprecated":false, "digest":{"function_hash":"273119325761839804296270056522454957983", "length":668}, "id":"ASB-A-465133716-2f7767ad", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/0570ed10b63de586efbe4bd3ac6c59ca4f4d9bbb", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"query"}}, {"deprecated":false, "digest":{"function_hash":"273975568050708746596117449317992794879", "length":990}, "id":"ASB-A-465133716-e2c5ab06", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/0570ed10b63de586efbe4bd3ac6c59ca4f4d9bbb", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"insert"}}]}}, {"package":{"name":"platform/packages/providers/ContactsProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/f281a7acfd2c79257c57009eda4dc4eeb418710c"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"275820184881413845175302596607676766459", "length":1033}, "id":"ASB-A-465133716-0afa3603", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/f281a7acfd2c79257c57009eda4dc4eeb418710c", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"update"}}, {"deprecated":false, "digest":{"function_hash":"234885050796259996493313331127043670853", "length":949}, "id":"ASB-A-465133716-32ddc5b4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/f281a7acfd2c79257c57009eda4dc4eeb418710c", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"delete"}}, {"deprecated":false, "digest":{"function_hash":"94411036843228921880291415215601056123", "length":1285}, "id":"ASB-A-465133716-97851bec", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/f281a7acfd2c79257c57009eda4dc4eeb418710c", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"insert"}}, {"deprecated":false, "digest":{"function_hash":"273119325761839804296270056522454957983", "length":668}, "id":"ASB-A-465133716-b48ced03", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/f281a7acfd2c79257c57009eda4dc4eeb418710c", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"query"}}, {"deprecated":false, "digest":{"line_hashes":["174109802260110429025126535300258579448", "61805258838576181967175519828738291817", "99276373545876684026409368586235741696", "104117919953874387096920762805432908424", "44905717540477058735536096648194851899", "253775033116321958565428467414583301252", "63815629847303037668932222887346538451", "2670960310369602436491354670582779299", "293136208918172338730680569222876507201", "310937112749657920413302397518481637823", "104128373343281123032534124348768326166", "18387634154170669671388436057341323992", "140941994007822631418484391586177374107", "284782678103595873297176302575901559363", "104128373343281123032534124348768326166", "150562261012211004977834823951934166130", "149883628856771879461821604510907118754", "177390120815022758096083881275067438441", "104128373343281123032534124348768326166", "289152166078996194694446288779704684673", "130185578066441930697048196985935568995", "295345443212088835607338847109546060955", "211382881051308093025017484833165007430", "320877382351371652279712052870875667691", "104128373343281123032534124348768326166", "329079589182380244815330219273344792087", "299010617626844963994754332333966742317", "62878674153116585571822223835893772099", "69802657251485483034272610549141850711", "247367063144086811135727449968378200560"], "threshold":0.9}, "id":"ASB-A-465133716-e5e7ea6a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/f281a7acfd2c79257c57009eda4dc4eeb418710c", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java"}}]}}, {"package":{"name":"platform/packages/providers/ContactsProvider", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/819ebe4a7c68b944bcb4db30cc941982a3de5313"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"234885050796259996493313331127043670853", "length":949}, "id":"ASB-A-465133716-3f5dcc2b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/819ebe4a7c68b944bcb4db30cc941982a3de5313", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"delete"}}, {"deprecated":false, "digest":{"function_hash":"273119325761839804296270056522454957983", "length":668}, "id":"ASB-A-465133716-5b6a570d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/819ebe4a7c68b944bcb4db30cc941982a3de5313", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"query"}}, {"deprecated":false, "digest":{"function_hash":"273975568050708746596117449317992794879", "length":990}, "id":"ASB-A-465133716-7acbd740", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/819ebe4a7c68b944bcb4db30cc941982a3de5313", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"insert"}}, {"deprecated":false, "digest":{"line_hashes":["174109802260110429025126535300258579448", "61805258838576181967175519828738291817", "99276373545876684026409368586235741696", "104117919953874387096920762805432908424", "44905717540477058735536096648194851899", "253775033116321958565428467414583301252", "63815629847303037668932222887346538451", "2670960310369602436491354670582779299", "293136208918172338730680569222876507201", "310937112749657920413302397518481637823", "104128373343281123032534124348768326166", "18387634154170669671388436057341323992", "140941994007822631418484391586177374107", "284782678103595873297176302575901559363", "104128373343281123032534124348768326166", "150562261012211004977834823951934166130", "149883628856771879461821604510907118754", "177390120815022758096083881275067438441", "104128373343281123032534124348768326166", "289152166078996194694446288779704684673", "130185578066441930697048196985935568995", "295345443212088835607338847109546060955", "211382881051308093025017484833165007430", "320877382351371652279712052870875667691", "104128373343281123032534124348768326166", "329079589182380244815330219273344792087", "299010617626844963994754332333966742317", "62878674153116585571822223835893772099", "69802657251485483034272610549141850711", "247367063144086811135727449968378200560"], "threshold":0.9}, "id":"ASB-A-465133716-cc0a4dda", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/819ebe4a7c68b944bcb4db30cc941982a3de5313", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java"}}, {"deprecated":false, "digest":{"function_hash":"275820184881413845175302596607676766459", "length":1033}, "id":"ASB-A-465133716-ec7ec490", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/819ebe4a7c68b944bcb4db30cc941982a3de5313", "target":{"file":"src/com/android/providers/contacts/ContactsProvider2.java", "function":"update"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/bb9f36b3ff6d42136afb61d527e1e8f67242fe32"}]}