CVE-2026-0075: SQL Injection
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the contacts database and the vulnerable application until code is fixed: tighten file and database permissions, limit local user accounts that can access the database, remove unnecessary privileges from local accounts, and disable or block interfaces to the contacts data for untrusted users.
- Compensating control
Enable and monitor detailed logging and alerting for the contacts database and the application: log database queries and access attempts, audit for anomalous or privileged queries that could indicate exploitation, and configure alerts for suspicious activity to support rapid detection and response.
- Operational
Identify and remediate the SQL injection in the code paths that access the contacts database: locate the vulnerable functions, replace dynamic/concatenated SQL with parameterized queries or prepared statements, add proper input validation and sanitization, and ensure database queries run with least-privilege accounts.
- Operational
If exploitation is suspected or confirmed, perform incident response: investigate affected hosts for indicators of compromise, contain and remediate impacted systems (rebuild or restore from trusted backups as needed), and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0075?
CVE-2026-0075 has a severity rating of high with a CVSS score of 7.8.
How do I fix CVE-2026-0075?
To fix CVE-2026-0075, update your Google Android software to the latest version as provided in the security bulletin.
What does CVE-2026-0075 affect?
CVE-2026-0075 affects multiple functions within the Google Android operating system.
Can CVE-2026-0075 be exploited without user interaction?
Yes, CVE-2026-0075 can be exploited without any user interaction required.
What kind of vulnerability is CVE-2026-0075?
CVE-2026-0075 is a SQL injection vulnerability that may allow local escalation of privilege.