In the Android Contacts Provider there is a missing permission check that allows an application to read the phone number and associated metadata of an incoming call. This flaw can result in local information disclosure to any app that can request contacts access. The vulnerability does not grant additional execution privileges and does not require user interaction, meaning the data can be retrieved purely by the presence of an incoming call.

The affected product is the Android operating system, produced by Google. No specific versions are listed in the available data.

The EPSS score indicates a probability of exploitation below 1%, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, targeting a device that has an ongoing incoming call, and does not require user interaction. The impact is limited to information disclosure; however, if an attacker can intercept sensitive call details this could assist other attack vectors.