Google Android EUVD-2026-33791

Local code execution on the target Android device is required (CVSS AV:L) - this vulnerability is not remotely exploitable over a network. However, no privileges are required to trigger the flaw (CVSS PR:N), meaning an unprivileged third-party application running on the device can invoke the vulnerable contacts database functions. No user interaction is needed after the app is installed and running (CVSS UI:N). The vulnerability exists in multiple unspecified functions within the contacts database layer; the specific function names or content provider URIs are not disclosed in available data. Exploitation is limited by the local attack vector and unchanged scope (S:U), meaning the attacker cannot directly pivot to other system components via this vulnerability alone. Affected platform versions are Android 14, 15, 16, and 16-qpr2 - devices running Android 13 or earlier, or fully patched devices on the June 2026 bulletin, are not confirmed as vulnerable.

The CVSS 3.1 base score of 5.9 (Medium) reflects a local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and limited impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The combination of PR:N and AV:L is particularly notable: while the attack is constrained to local access, no privilege level is needed to trigger it, meaning any unprivileged application running on the device is a potential threat actor. EPSS at 0.01% (0th percentile) indicates extremely low historical exploitation probability and no observed mass exploitation at time of analysis. No CISA KEV entry exists and no public POC has been identified, so this remains a theoretical but credible risk vector for targeted device compromise or malware-assisted contact data exfiltration. The CVSS score is consistent with the actual impact ceiling - local scope and limited per-dimension impact prevent a higher rating. Overall, this is a genuine but lower-urgency finding unless the deployment context involves high-sensitivity contact data or elevated threat actor interest.

A malicious Android application installed on the device without any special declared permissions invokes a vulnerable contacts database function and supplies a crafted SQL payload as part of a query parameter. The injected SQL causes the database to return or modify contact records outside the caller's normal access scope, effectively escalating the application's local privileges and exposing or altering victim contact data. No public proof-of-concept exploit code has been identified, but the low complexity (AC:L) of the CVSS vector indicates that exploitation does not require advanced techniques once the vulnerable function is identified.