CVE-2026-0075: Android ContactsProvider SQL Side‑Channel Vulnerability Deep Dive and PoC

Vulnerability Overview

CVE-2026-0075 is a high‑severity local privilege‑escalation and information‑leak vulnerability in Android's ContactsProvider2. An app that declares no contacts permissions can craft specific data requests and use SQLite error‑message side‑channels to extract sensitive contacts data.

Affected Versions: Android 14, Android 15, Android 16, Android 16 QPR2.

Fix Versions: Security patches released on June 5 2026 and later address the issue.

Severity: High (CVSS score not yet assigned by NVD).

Technical Principle

Where the problem lies

ContactsProvider2 returns detailed SQLite exception information to callers that lack the READ_CONTACTS permission. These exception messages contain internal state data that attackers can analyze to infer the actual contents of the contacts database.

This constitutes an SQL side‑channel attack : rather than injecting malicious SQL, the attacker observes differences in error messages to deduce sensitive information.

Google’s mitigation (AOSP commit bb9f36b3ff6d42136afb61d527e1e8f67242fe32, titled "Fix side channel attacks in CP2") implements two changes:

Strip sensitive information: For callers without READ_CONTACTS, JSON‑related details are removed from SQLiteException messages.

Normalize exception paths: Cursor instantiation is moved into the exception‑handling flow to prevent inference from the location where the error is triggered.

Proof‑of‑Concept Details

Researcher QM4RS released a full proof‑of‑concept on GitHub (qm4rs/CVE-2026-0075) consisting of a custom Android app and a PowerShell build script.

PoC Features

No contact permissions declared: AndroidManifest.xml lacks READ_CONTACTS or WRITE_CONTACTS.

Limited URI grant: Uses precise data/<id> URI with read grant.

Designed for controlled experiments: Enables comparison of behavior before and after the fix.

Build Steps

Required environment:

Windows + PowerShell 5.1 or PowerShell 7+

JDK (javac, jar, keytool in PATH)

Android SDK Platform android-35

Android SDK Build‑Tools 36.0.0

Android Platform Tools (adb)

Set Android SDK path: $env:ANDROID_HOME = 'C:\Android\Sdk' Compile and package:

Set-Location .
o-permission-probe
.\build.ps1

After a successful build, the signed APK is located at no-permission-probe\build\probe.apk.

Run the PoC:

# Verify device
adb devices
adb shell getprop ro.build.version.security_patch

# Install and run
Set-Location .
o-permission-probe
.\run-poc.ps1

# View log output
adb logcat -s CVE20260075Probe:I

Verification Method

Record the following for each run to ensure reproducibility:

Device model or emulator image, Android version, build fingerprint, security‑patch level.

Exact limited URI grant used.

Confirm the target contains only synthetic test contacts.

Log whether each call returns a result, a cleaned exception, a raw exception, or a permission denial.

Note where the exception occurs: provider call phase or cursor consumption phase.

Compare pre‑ and post‑fix behavior: after the fix, callers receive a generic SQLite error message instead of the original JSON‑rich exception.

Exploitation Limits

The PoC is build‑specific and does not prove that every device with the same Android version is exploitable; vendor customizations may affect the provider implementation.

Do not run the PoC on unauthorized production devices or real contact data.

Do not treat this as a universal exploit proof.

Testing must be performed in a controlled environment (emulator or authorized test device) with synthetic data.

Timeline

June 2026: Google disclosed and patched the vulnerability in the Android Security Bulletin.

August 2026: Researcher QM4RS published the full PoC and analysis.

Impact and Summary

Although the vulnerability requires a malicious app to be installed, it enables silent data leakage and bypasses Android’s permission model, allowing targeted information collection.

Undetectable leakage: Once installed, the app can infer contacts via the side channel without user awareness.

Permission model bypass: The usual permission check is ineffective in this scenario.

Highly targeted: Attackers can select specific victims for data collection.

Users of Android 14‑16 or 16 QPR2 should verify that their security‑patch level is June 5 2026 or later and update if necessary.

PoC repository: https://github.com/qm4rs/cve-2026-0075

References:

Android Security Bulletin – June 2026: https://source.android.com/docs/security/bulletin/2026/2026-06-01

AOSP fix commit: https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/bb9f36b3ff6d42136afb61d527e1e8f67242fe32

NVD entry: CVE-2026-0075