CVE-2026-0057: Low severity Google Android Contacts Provider vulnerability
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the Contacts Provider to perform and enforce a permission check before returning an incoming call's phone number and associated metadata; ensure only callers granted the required permission can access this information.
Contacts Provider permission check for access to incoming call phone number and metadata = enforce a permission check (require caller to hold the appropriate permission)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0057?
CVE-2026-0057 has a risk score of 33, indicating a moderate level of vulnerability.
How do I fix CVE-2026-0057?
To mitigate CVE-2026-0057, ensure your Google Android device is updated to the latest software version that addresses this vulnerability.
What type of information can be disclosed by exploiting CVE-2026-0057?
Exploiting CVE-2026-0057 may lead to unauthorized access to an incoming call's phone number and associated metadata.
Is user interaction required to exploit CVE-2026-0057?
No, user interaction is not needed for exploitation of CVE-2026-0057.
Which software is affected by CVE-2026-0057?
CVE-2026-0057 affects the Google Android Contacts Provider.