A-499298430: Android/platform/packages/apps/contactspicker vulnerability

Q: How can teams determine whether a deployed build is affected?

The available information does not identify affected Android versions or patch levels. Review the referenced Android security bulletin and OSV record for build-specific applicability information.

Q: When was this issue published and most recently updated?

It was published on 2026-11-01 and modified on 2026-11-03.

Published Nov 1, 2026

Updated

In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

2 affected componentsFixes available

android/platform/packages/apps/contactspicker>=17-qpr2-next:0<17-qpr2-next:2026-11-01

17-qpr2-next:2026-11-01

android/platform/packages/apps/contactspicker>=17:0<17:2026-11-01

17:2026-11-01

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

How can teams determine whether a deployed build is affected?

The available information does not identify affected Android versions or patch levels. Review the referenced Android security bulletin and OSV record for build-specific applicability information.

When was this issue published and most recently updated?

It was published on 2026-11-01 and modified on 2026-11-03.

A-499298430: Android/platform/packages/apps/contactspicker vulnerability

Affected Software

Event History

Frequently Asked Questions

How can teams determine whether a deployed build is affected?

When was this issue published and most recently updated?

Company

Resources

Contact

Frequently Asked Questions

How can teams determine whether a deployed build is affected?

When was this issue published and most recently updated?