{"uuid": "fa1e0698-2ff2-4122-87fb-000fbaf07c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0075", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117123782623988879", "content": "\ud83d\udea8 Public PoC available for high-severity Android ContactsProvider flaw\nhttps://github.com/qm4rs/cve-2026-0075\nCVE-2026-0075 affects Android 14, 15, 16, and 16 QPR2 and can allow access to information from the contacts database through a SQL-related side channel without user interaction.\nResearcher QM4RS has now released a controlled Android PoC that intentionally requests neither READ_CONTACTS nor WRITE_CONTACTS.\nThe issue involves ContactsProvider2 returning detailed SQLite errors to callers that lack contacts permission. Those errors could potentially be abused as an information side channel.\nGoogle's fix strips sensitive JSON-related SQLite exception details from unauthorized callers.\nThe researcher cautions that the PoC is build-specific and does not demonstrate a universal exploitation path across every Android device.\nDevices with the June 5, 2026 Android security patch level or later address the issue.", "creation_timestamp": "2026-08-19T19:18:14.400287Z"}