## https://sploitus.com/exploit?id=E659123E-CF18-57B9-95FC-03A3A518C38E
# CVE-2026-0075 ContactsProvider Research PoC
> A controlled-lab Android research prototype for evaluating the observable behavior associated with CVE-2026-0075 in ContactsProvider2.
## Overview
CVE-2026-0075 is an Android local elevation-of-privilege issue in ContactsProvider2. The public advisory describes a possible path to contacts-database access through SQL injection, without user interaction. Android lists the issue as **High** and identifies Android 14, 15, 16, and 16-qpr2 as affected AOSP versions. Devices with the `2026-06-05` security patch level or later address the June 2026 bulletin issues.
The included app is a standalone Java/Android PoC that intentionally declares neither `READ_CONTACTS` nor `WRITE_CONTACTS`. It is intended to help authorized researchers compare permission-boundary behavior and exception handling on controlled builds.
## Scope and safety
This repository is for authorized security research only.
- Use a disposable emulator or lab device that you own or are explicitly authorized to test.
- Seed the target only with synthetic contact data.
- Do not use the PoC against production devices, third-party devices, or real contact databases.
- Treat results as build-specific. A successful observation on one image is not proof that every device on the same Android version is vulnerable.
The project does not claim a universal exploitation path. It records a controlled observation that must be validated against the target build, its patch level, and its ContactsProvider implementation.
## Repository layout
```text
.
├── no-permission-probe/ Standalone Android application and PowerShell helpers
│ ├── build.ps1 Compiles, packages, aligns, and signs a debug APK
│ ├── run-poc.ps1 Installs the APK and starts the controlled probe
│ ├── AndroidManifest.xml No READ_CONTACTS or WRITE_CONTACTS declaration
│ ├── res/ Android resources
│ └── src/ Application source
├── CONTRIBUTING.md Contribution and research-data requirements
├── SECURITY.md Vulnerability reporting guidance
└── .gitignore Local build and IDE exclusions
```
## Technical context
The public AOSP fix, `bb9f36b3ff6d42136afb61d527e1e8f67242fe32`, is titled *Fix side channel attacks in CP2*. It changes `ContactsProvider2` to strip JSON-related `SQLiteException` messages for callers without `READ_CONTACTS`, and brings cursor materialization into the exception-handling path. This PoC is designed for controlled before/after behavioral comparison; it does not substitute for patch validation.
## Prerequisites
- Windows with PowerShell 5.1 or PowerShell 7+
- JDK with `javac`, `jar`, and `keytool` available on `PATH`
- Android SDK Platform `android-35`
- Android SDK Build-Tools `36.0.0`
- Android Platform Tools (`adb`)
- An authorized emulator or test device populated only with synthetic contacts
Set `ANDROID_HOME` to the SDK root before building. `ANDROID_SDK_ROOT` may also be used by your local tooling, but the provided scripts read `ANDROID_HOME`.
```powershell
$env:ANDROID_HOME = 'C:\Android\Sdk'
```
## Build
From the repository root:
```powershell
Set-Location .\no-permission-probe
.\build.ps1
```
The signed debug APK is written to `no-permission-probe\build\probe.apk`. The `build` directory is excluded from version control.
## Controlled lab run
1. Start an authorized emulator or test device containing only synthetic contacts.
2. Confirm the device and patch level:
```powershell
adb devices
adb shell getprop ro.build.version.security_patch
```
3. Build the app, then run:
```powershell
Set-Location .\no-permission-probe
.\run-poc.ps1
```
4. Review only the application UI and the scoped log tag:
```powershell
adb logcat -s CVE20260075Probe:I
```
The run helper selects an exact `data/` URI from the connected test device and launches the activity with a read grant. Do not use it where that behavior is not explicitly authorized.
## Validation guidance
For a defensible result, capture the following with every run:
- Device model or emulator image, Android release, build fingerprint, and security patch level
- The exact limited URI grant used for the test
- Confirmation that only synthetic contacts were present
- Whether a call produces a result, a sanitized exception, an unsanitized exception, or a permission denial
- The point at which an exception occurs: provider call or cursor consumption
Compare a known vulnerable lab image with an image that contains the June 2026 fix. The expected remediation signal is that qualifying JSON-related SQLite errors returned to callers lacking `READ_CONTACTS` are replaced with a generic message; this does not by itself establish the absence of every observable oracle.
## Security status
This CVE was publicly disclosed and addressed in the June 2026 Android Security Bulletin. For current Android product vulnerabilities, report directly through the [Android Security](https://source.android.com/docs/security/overview/updates-resources#report-issues) process. See [SECURITY.md](SECURITY.md) for repository-specific guidance.
## References
- [Android Security Bulletin — June 2026](https://source.android.com/docs/security/bulletin/2026/2026-06-01)
- [AOSP fix: `bb9f36b3ff6d42136afb61d527e1e8f67242fe32`](https://android.googlesource.com/platform/packages/providers/ContactsProvider/+/bb9f36b3ff6d42136afb61d527e1e8f67242fe32)
- [NVD: CVE-2026-0075](https://nvd.nist.gov/vuln/detail/CVE-2026-0075)
## License
Licensed under the [Apache License 2.0](LICENSE).