CVE-2026-28576PoC(google / android)

MEDIUMCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

Patch google android systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

google CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://source.android.com/docs/security/bulletin/android-17

Weakness type (CWE)

CWE-89

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

android

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 5 signals
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 9 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 4d ago at 5 mentions (2026-09-08); latest day: 3
13 total mentions across 5 days

Affected systems

Vendors

google

Products

android

1 version affected across 1 product

Deep dive

Activity timeline13 mentions / 5d

Signal classification4 categories

PoC

646.2%

Disclosure

430.8%

General

215.4%

Exploit

17.7%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-08	5	Disclosure2General1PoC2
2026-09-11	3	Exploit1PoC2
2026-09-14	1	Disclosure1
2026-09-22	1	Disclosure1
2026-09-24	3	General1PoC2

Full discourse13 posts

ThreatWire@ThreatWire_43d
PoC
🚨 PoC RELEASED: Public exploit code is now available for CVE-2026-28576, a CVSS 10.0 SQL injection vulnerability in the Android Contacts Provider. The flaw can allow access to the device’s contacts database without additional execution privileges or user interaction, potentially exposing sensitive contact information. ⚠️ A public PoC demonstrates how the vulnerability can be exploited to extract contacts from affected Android devices. 🔴 Android 17 users should apply the latest available security updates. 🔗 http://github.com/mobilehackinglab/CVE-2026-28576-poc #Android #CVE #PoC #SQLInjection #ContactsProvider #CyberSecurity #Infosec
Post summary
A PoC and public exploit code for the high-severity CVE‑2026‑28576 SQL injection in Android Contacts Provider has been released, urging Android 17 users to apply updates.
147217613724.9K
1.8K followersView on X
Mobile Hacker@androidmalware245d
Disclosure
One tap. No contact permission. Your entire contact list could be exposed. CVE-2026-28576 is a vulnerability that can bypass #Android’s normal contact-access protection by misusing SQL injection in Android system component https://t.co/0620DpNNxR
Post summary
The tweet announces CVE‑2026‑28576, a SQL injection flaw in an Android system component that can expose users’ contact lists without permission.
12901851128.0K
61.3K followersView on X
Rıdvan Yağlı@ridvanyagli43d
PoC
🔴 Android 17'deki CVE-2026-28576 için public PoC yayınlandı. CVSS v4 10.0 olarak skorlanan Contacts Provider'daki SQL Injection açığı, kötü amaçlı bir uygulamanın READ_CONTACTS izni olmadan, Contact Picker üzerinden yalnızca bir kişi için verilen erişimi kötüye kullanarak diğer kişi kayıtlarını okumasına yol açabiliyor. Public PoC ile kişi adı, telefon ve e-posta bilgilerinin çıkarılabildiği gösterildi. ⚠️ Etkilenen sürümler: Android 17, 2026-07-01 öncesi security patch level. Android 17 kullanıcılarının cihazlarını en güncel güvenlik güncellemeleriyle yamalamaları öneriliyor. https://github.com/mobilehackinglab/CVE-2026-28576-poc
Post summary
A public Proof of Concept for CVE-2026-28576 has been released, demonstrating an SQL injection in Android 17's Contacts Provider, and the post urges users to apply the latest security patches.
0201371.1K
2.4K followersView on X
Mobile Hacker@androidmalware245d
PoC
Android 17 devices with the July 1, 2026 security patch or newer are protected. This PoC was replicated and documented by MobileHackingLab Blog: https://www.mobilehackinglab.com/blog/cve-2026-28576-contacts-provider-sqli PoC APK: https://github.com/mobilehackinglab/CVE-2026-28576-poc https://t.co/L0i8FnJgcK
Post summary
A Proof of Concept (PoC) for CVE-2026-28576, a SQL injection in Android 17’s contacts provider, has been documented by MobileHackingLab and is mitigated by the July 2026 security patch.
0208111.2K
61.3K followersView on X
Daily CyberSecurity@Daily_CyberSec43d
Exploit
CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now. #CVE202628576 #Android #SQLInjection #Android17 #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel https://securityonline.info/cve-2026-28576-android-contacts-sqli/
Post summary
CVE‑2026‑28576 is a critical SQL injection in Android's Contacts Provider, with a public PoC that dumps all contacts without permissions; a patch is available in Android 17.
02062675
13.0K followersView on X
ExploitGrid@exploitgrid29d
General
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2026-28576 CVE-2024-2876 CVE-2026-13355 CVE-2026-19658 CVE-2026-41089 ..🧵👇
Post summary
The text is a brief daily threat digest listing five CVEs labeled as 'Critical Exploits disclosed today' with no technical details, PoC links, patches, or exploitation evidence provided in the tweet itself.
2001077
305 followersView on X
ExploitGrid@exploitgrid29d
PoC
[EXPLOIT] CVE-2026-28576 [CRITICAL/PoC] cve-2026-28576 🔗 https://exploitgrid.net/exploits/2e49fe18-7b6c-4cf4-88e7-22feff69c932
Post summary
The tweet explicitly tags CVE-2026-28576 as [EXPLOIT/CRITICAL/PoC] and includes a link to an exploit grid, indicating a Proof of Concept is the primary focus, though no specific exploit tool or active exploitation claims are provided in the text.
1000042
305 followersView on X
ExploitGrid@exploitgrid29d
PoC
💀 CRITICAL Exploits Trending ├ CVE-2026-41089 — Netlogon RCE · PoC live ├ CVE-2026-28576 · CVE-2024-2876 · PoC live └ CVE-2026-13355 · CVE-2026-19658 · PoC live +497 more tracked today.
Post summary
The post highlights several critical CVEs with live proof-of-concept code, emphasizing the availability of PoCs rather than detailing exploits or patches.
1000070
305 followersView on X
ExploitGrid@exploitgrid45d
PoC
[EXPLOIT] EGE-GH-Nu0Urmg [CRITICAL/PoC] Linked: CVE-2026-28576 CVE-2026-28576-poc 🔗 https://exploitgrid.net/exploits/cf432d3c-8b41-4ef0-9d1d-ebb298edaff7
Post summary
A proof‑of‑concept exploit for CVE‑2026‑28576 is available and linked, but there is no indication of active exploitation or patch status.
1000050
41 followersView on X
ExploitGrid@exploitgrid45d
Disclosure
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2024-3094 CVE-2025-31324 CVE-2025-55182 CVE-2025-57819 CVE-2026-28576 ..🧵👇
Post summary
The tweet announces a set of five newly disclosed CVEs, labeling them as critical exploits, but offers no additional technical details, proof of concept, or mitigation information.
1000051
41 followersView on X
ArmoredMobile@ArmoredMobile45d
General
Source: https://www.mobilehackinglab.com/blog/cve-2026-28576-contacts-provider-sqli
Post summary
The text references CVE‑2026‑28576 as a SQL injection vulnerability in the Contacts Provider, but provides no additional information about PoC, exploitation activity, or patch status.
0001036
75 followersView on X
cybrmonk@cybr_monk31d
Disclosure
CVE-2026-28576 Lets Attackers Dump Android Contacts With One Click https://cybrmonk.com/blog/cve-2026-28576-lets-attackers-dump-android-contacts-with-one-click #cybersecurity #threatintelligence https://t.co/Xi6u3f24V4
Post summary
The tweet announces CVE-2026-28576, highlighting its impact ('one-click contact dumping') without technical specifics, exploit tools, active exploitation evidence, or remediation. It serves as a brief disclosure of a newly identified Android vulnerability.
0000041
45 followersView on X
キタきつね@foxbook39d
Disclosure
Android Contacts SQL Injection Flaw CVE-2026-28576（Android連絡先にSQLインジェクション脆弱性、情報漏えいの恐れ） #SecurityOnline （Sep 11） https://securityonline.info/cve-2026-28576-android-contacts-sqli/
Post summary
The text announces CVE-2026-28576, an SQL injection flaw in Android Contacts with potential information leakage risk, and links to a detailed advisory page. No exploit tools, patches, or active exploitation claims are present.
00000278
5.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	google	android	17.0	-	-

Explore more

Back to dashboard google CVEs android vulnerabilities

What researchers are saying

CVE-2026-28576

ThreatWire[verified]@ThreatWire_PoC

A PoC and public exploit code for the high-severity CVE‑2026‑28576 SQL injection in Android Contacts Provider has been released, urging Android 17 users to apply updates.

Rıdvan Yağlı[verified]@ridvanyagliPoC

A public Proof of Concept for CVE-2026-28576 has been released, demonstrating an SQL injection in Android 17's Contacts Provider, and the post urges users to apply the latest security patches.

ArmoredMobile[verified]@ArmoredMobileGeneral

The text references CVE‑2026‑28576 as a SQL injection vulnerability in the Contacts Provider, but provides no additional information about PoC, exploitation activity, or patch status.

キタきつね[verified]@foxbookDisclosure

The text announces CVE-2026-28576, an SQL injection flaw in Android Contacts with potential information leakage risk, and links to a detailed advisory page. No exploit tools, patches, or active exploitation claims are present.

Mobile Hacker@androidmalware2Disclosure

The tweet announces CVE‑2026‑28576, a SQL injection flaw in an Android system component that can expose users’ contact lists without permission.

Mobile Hacker@androidmalware2PoC

A Proof of Concept (PoC) for CVE-2026-28576, a SQL injection in Android 17’s contacts provider, has been documented by MobileHackingLab and is mitigated by the July 2026 security patch.

Daily CyberSecurity@Daily_CyberSecExploit

CVE‑2026‑28576 is a critical SQL injection in Android's Contacts Provider, with a public PoC that dumps all contacts without permissions; a patch is available in Android 17.

ExploitGrid@exploitgridGeneral

The text is a brief daily threat digest listing five CVEs labeled as 'Critical Exploits disclosed today' with no technical details, PoC links, patches, or exploitation evidence provided in the tweet itself.