CVE-2026-28576: Android Contacts Provider SQL Injection and Systemic Exfiltration

Executive Summary

CVE-2026-28576 is a critical access control vulnerability in the Android Contacts Provider framework (ContactsProvider2.queryLocal()). The flaw enables an unprivileged application installed locally with zero declared permissions to exfiltrate an entire device's contacts database, including full names, telephone numbers, postal addresses, and email addresses.

Vulnerability Details

Root Cause

The vulnerability exists in ContactsProvider2.queryLocal() method within the Android Contacts Provider framework (packages/providers/ContactsProvider). The method constructs SQL queries using unsanitized user-controlled input, allowing SQL injection through the selection and selectionArgs parameters passed via ContentResolver.query().

Affected Code Path

ContentResolver.query()
    → ContactsProvider2.query()
        → ContactsProvider2.queryLocal()  [VULNERABLE]
            → SQLiteQueryBuilder.buildQuery()
                → Raw SQL execution with unsanitized input

Vulnerable Parameters

• selection (String): WHERE clause without parameterization
• selectionArgs (String[]): Arguments that are improperly escaped
• uri (Uri): Content URI targeting content://com.android.contacts/...

Exploitation Prerequisites

• Zero permissions required - No READ_CONTACTS, READ_PRIVILEGED_PHONE_STATE, or any dangerous permissions
• No user interaction - Silent background exploitation
• Local app installation - Any app installed on device (Play Store, sideloaded, etc.)
• Android versions - Affected versions prior to Android 17 security patch (June 2026)

Technical Analysis

SQL Injection Mechanism

The queryLocal() method processes the selection parameter by directly concatenating it into the SQL WHERE clause without proper parameterization:

// Simplified vulnerable pattern in ContactsProvider2.java
public Cursor queryLocal(Uri uri, String[] projection, String selection,
                         String[] selectionArgs, String sortOrder) {
    SQLiteQueryBuilder qb = new SQLiteQueryBuilder();
    qb.setTables(Tables.CONTACTS);
    
    // VULNERABLE: selection directly interpolated into SQL
    String whereClause = buildWhereClause(selection, selectionArgs);
    
    Cursor c = qb.query(db, projection, whereClause, null, null, null, sortOrder);
    return c;
}

An attacker crafts a malicious selection parameter such as:

"1=1) UNION SELECT _id, display_name, phone_number, email_address, postal_address FROM raw_contacts--"

This bypasses the intended query logic and extracts all contact fields.

Data Exfiltration Scope

Attack Flow

graph TD
    A[Malicious App Installed] --> B[Request ContentResolver.query]
    B --> C[Craft SQL Injection Payload]
    C --> D[Target content://com.android.contacts/data]
    D --> E[ContactsProvider2.queryLocal]
    E --> F[Unsanitized selection parameter]
    F --> G[SQL Injection Executed]
    G --> H[Full Contacts DB Returned]
    H --> I[Exfiltrate via Network/Logs]

Impact Assessment

Confidentiality Impact: HIGH

• Complete contacts database exfiltration
• PII exposure: names, phones, emails, addresses
• Corporate contact leakage (BYOD scenarios)
• Social engineering enablement (spear phishing, vishing)

Integrity Impact: HIGH

• Potential contact data manipulation via UNION/UPDATE injection
• Contact spoofing for social engineering
• Malicious contact insertion

Availability Impact: HIGH

• DoS via resource exhaustion (massive query results)
• Database locking/blocking
• Provider crash via malformed queries

Regulatory Impact

• GDPR: Personal data breach (Art. 33 notification required)
• CCPA: Unauthorized personal information access
• HIPAA: Potential PHI exposure if medical contacts stored
• PCI DSS: Cardholder data in contact notes exposure

Affected Versions

Vendor Advisories

• Google Android Security Bulletin: Android 17 (June 2026)
• GitHub Advisory: GHSA-ph86-9mcx-3p6r
• NVD: CVE-2026-28576 (published June 17, 2026)

Detection & Mitigation

Detection Rules

YARA Rule

rule Android_ContactsProvider_SQLi_CVE_2026_28576 {
    meta:
        description = "Detects SQL injection payloads targeting ContactsProvider"
        cve = "CVE-2026-28576"
        severity = "critical"
    strings:
        $s1 = "content://com.android.contacts" nocase
        $s2 = "UNION SELECT" nocase
        $s3 = "raw_contacts" nocase
        $s4 = "data1" nocase
        $s5 = "1=1" nocase
    condition:
        $s1 and 2 of ($s2, $s3, $s4, $s5)
}

Network Detection (Suricata)

alert http any any -> any any (
    msg:"CVE-2026-28576 Contacts Exfiltration";
    flow:established,to_server;
    content:"contacts";
    http.uri;
    pcre:"/UNION.*SELECT.*raw_contacts/i";
    classtype:web-application-attack;
    sid:202628576;
    rev:1;
)

Mitigation Strategies

1. Immediate: Apply Android 17 June 2026 security patch
2. Workaround: Restrict ContentResolver.query() via SELinux policy
3. Monitoring: Audit ContactsProvider query logs for anomalous selection parameters
4. App Vetting: Scan apps for content://com.android.contacts URI usage without READ_CONTACTS permission

References

• GitHub Advisory GHSA-ph86-9mcx-3p6r
• NVD CVE-2026-28576
• Android Security Bulletin - Android 17
• Android Bug A-488593616
• CWE-89: SQL Injection

Document generated for CVE-2026-28576 research repository Last updated: September 2025