Google Android CVE-2026-58821

Exploitation requires local access to the device - specifically code already executing on the Android device, such as a malicious or compromised application, since the CVSS vector is AV:L (local). Within that constraint there are no further special conditions: no privileges (PR:N) and no user interaction (UI:N) are required, and no non-default configuration is indicated by the available sources. The scope of impact is limited to local denial of service (A:H only; C:N/I:N) on the affected Android versions (Android 16, Android 17, Android 16-qpr2). The primary limiting factor is the absence of any remote/network path, meaning an attacker must first achieve on-device code execution; the exact triggering code path in SearchRequestDatabaseUtil.java is not described in the available sources beyond 'multiple functions'.

This is a moderate, low-urgency issue (CVSS 6.2) despite the SQL-injection mechanism (CWE-89). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is explicit that the only impact is availability (A:H) via local denial of service - confidentiality and integrity are rated None. This creates a notable tension with the description, which states the flaw allows 'a possible way to access protected data'; the authoritative CVSS scoring (C:N/I:N) does NOT support a confidentiality/data-disclosure outcome, so the practical impact is a local DoS, not data theft - this discrepancy should be verified against the Android bulletin. Exploitation signals all point to low real-world priority: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit was identified in the provided references. The vuln.today decision label is 'this_month' (routine patch cadence), not act_now or emergency. The limiting factor is the local attack vector (AV:L): exploitation requires code already running on the device (e.g. a malicious or compromised app), not a remote network path, which substantially narrows the realistic threat to scenarios where an attacker already has a foothold.

A malicious or compromised application already installed on an Android device issues crafted input to the vulnerable SearchRequestDatabaseUtil functions, injecting SQL that corrupts or crashes the affected database operation and causes a local denial of service. No user interaction and no additional execution privileges are required (AV:L/PR:N/UI:N). No public proof-of-concept or exploit code was identified in the provided sources.