An SQL injection flaw exists in the Android Contacts Provider that allows a local actor to read the entire contacts database without needing elevated privileges. This vulnerability, classified as CWE-89, provides an attacker the ability to extract personal data from a device. The impact is a breach of user confidentiality and can reveal sensitive contact details.

The flaw is present in Android’s Contacts Provider component. Specific affected Android releases are not listed, so all devices running the current or older versions of Android that include this provider are potentially impacted until a fix is applied.

The CVSS score of 10 indicates a critical severity rating. However, the EPSS score is under 1%, implying the likelihood of exploitation is currently low. The vulnerability is local and does not require user interaction, so any application running on the device could leverage it. Because the flaw is not listed in CISA’s KEV catalog there is no known large‑scale exploitation activity recorded at this time.