CVE-2026-28576: critical vulnerability in Android
Published
50Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 0.2%
from disclosure to weapon82 days
Published on NVDJun 17
1st PoC+82d
exploitation probability
0.2%top 93% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Android · Androidpublic PoCs found — 1
githubgithub.com/mobilehackinglab/CVE-2026-28576-poc★ 37⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Android
In the same product, most dangerous first.