CVE-2026-0075 ContactsProvider Research PoC

A controlled-lab Android research prototype for evaluating the observable behavior associated with CVE-2026-0075 in ContactsProvider2.

Overview

CVE-2026-0075 is an Android local elevation-of-privilege issue in ContactsProvider2. The public advisory describes a possible path to contacts-database access through SQL injection, without user interaction. Android lists the issue as High and identifies Android 14, 15, 16, and 16-qpr2 as affected AOSP versions. Devices with the 2026-06-05 security patch level or later address the June 2026 bulletin issues.

The included app is a standalone Java/Android PoC that intentionally declares neither READ_CONTACTS nor WRITE_CONTACTS. It is intended to help authorized researchers compare permission-boundary behavior and exception handling on controlled builds.

Scope and safety

This repository is for authorized security research only.

• Use a disposable emulator or lab device that you own or are explicitly authorized to test.
• Seed the target only with synthetic contact data.
• Do not use the PoC against production devices, third-party devices, or real contact databases.
• Treat results as build-specific. A successful observation on one image is not proof that every device on the same Android version is vulnerable.

The project does not claim a universal exploitation path. It records a controlled observation that must be validated against the target build, its patch level, and its ContactsProvider implementation.

Repository layout

.
├── no-permission-probe/       Standalone Android application and PowerShell helpers
│   ├── build.ps1              Compiles, packages, aligns, and signs a debug APK
│   ├── run-poc.ps1            Installs the APK and starts the controlled probe
│   ├── AndroidManifest.xml    No READ_CONTACTS or WRITE_CONTACTS declaration
│   ├── res/                   Android resources
│   └── src/                   Application source
├── CONTRIBUTING.md            Contribution and research-data requirements
├── SECURITY.md                Vulnerability reporting guidance
└── .gitignore                 Local build and IDE exclusions

Technical context

The public AOSP fix, bb9f36b3ff6d42136afb61d527e1e8f67242fe32, is titled Fix side channel attacks in CP2. It changes ContactsProvider2 to strip JSON-related SQLiteException messages for callers without READ_CONTACTS, and brings cursor materialization into the exception-handling path. This PoC is designed for controlled before/after behavioral comparison; it does not substitute for patch validation.

Prerequisites

• Windows with PowerShell 5.1 or PowerShell 7+
• JDK with javac, jar, and keytool available on PATH
• Android SDK Platform android-35
• Android SDK Build-Tools 36.0.0
• Android Platform Tools (adb)
• An authorized emulator or test device populated only with synthetic contacts

Set ANDROID_HOME to the SDK root before building. ANDROID_SDK_ROOT may also be used by your local tooling, but the provided scripts read ANDROID_HOME.

$env:ANDROID_HOME = 'C:\Android\Sdk'

Build

From the repository root:

Set-Location .\no-permission-probe
.\build.ps1

The signed debug APK is written to no-permission-probe\build\probe.apk. The build directory is excluded from version control.

Controlled lab run

1. Start an authorized emulator or test device containing only synthetic contacts.

2. Confirm the device and patch level:

   root@kitploit:~

   adb devices
   adb shell getprop ro.build.version.security_patch
   

3. Build the app, then run:

   root@kitploit:~

   Set-Location .\no-permission-probe
   .\run-poc.ps1
   

4. Review only the application UI and the scoped log tag:

   root@kitploit:~

   adb logcat -s CVE20260075Probe:I
   

The run helper selects an exact data/<id> URI from the connected test device and launches the activity with a read grant. Do not use it where that behavior is not explicitly authorized.

Validation guidance

For a defensible result, capture the following with every run:

• Device model or emulator image, Android release, build fingerprint, and security patch level
• The exact limited URI grant used for the test
• Confirmation that only synthetic contacts were present
• Whether a call produces a result, a sanitized exception, an unsanitized exception, or a permission denial
• The point at which an exception occurs: provider call or cursor consumption

Compare a known vulnerable lab image with an image that contains the June 2026 fix. The expected remediation signal is that qualifying JSON-related SQLite errors returned to callers lacking READ_CONTACTS are replaced with a generic message; this does not by itself establish the absence of every observable oracle.

Security status

This CVE was publicly disclosed and addressed in the June 2026 Android Security Bulletin. For current Android product vulnerabilities, report directly through the Android Security process. See SECURITY.md for repository-specific guidance.

References

• Android Security Bulletin — June 2026
• AOSP fix: bb9f36b3ff6d42136afb61d527e1e8f67242fe32
• NVD: CVE-2026-0075

License

Licensed under the Apache License 2.0.