PoC Exploit Released for Android CVE-2026-0075 Allowing Contact Theft Without READ_CONTACTS Permission
A researcher has published a proof-of-concept exploit for vulnerability CVE-2026-0075 in Android. The flaw resided in the system component ContactsProvider2 and allowed a local application to reach the contacts database via SQL injection even when the user had never granted the READ_CONTACTS permission.
No additional user interaction or confirmation dialogs were required. The vulnerability stemmed from overly verbose SQLite error messages returned by ContactsProvider2 when specially crafted queries triggered database errors. By analyzing these responses, an application without any contact permissions could gradually reconstruct entries from the contacts database.
Google assigned the issue a high severity rating. It affects Android 14, Android 15, Android 16 and Android 16 QPR2, according to the June 2026 Android security bulletin. The official patch removes detailed JSON error information from responses sent to applications lacking contact access rights, replacing it with a generic message.
The PoC exploit published on GitHub intentionally does not request READ_CONTACTS or WRITE_CONTACTS permissions. Its author designed it for controlled laboratory testing to compare the behavior of patched and vulnerable builds. The researcher notes that a successful test on one device does not prove the vulnerability exists on every smartphone running the same Android version.
No confirmed cases of real-world exploitation of CVE-2026-0075 have been observed so far. However, the availability of public exploit code makes it unrealistic to expect older, unpatched firmware to remain safe. Users should check their device security update level in settings and ensure installation of the patch dated 5 June 2026 or newer.
Related articles
Asset and Vulnerability Management in Practice: Building a Working Process with MaxPatrol VM and NetBox
This detailed guide explains how organizations can implement effective asset and vulnerability management by focusing on reliable infrastructure data, IT collaboration, and automation. It draws from real-world projects using MaxPatrol VM, NetBox, and 1C:ERP to demonstrate dynamic grouping, webhook-driven asset onboarding, and deviation-based control. The approach emphasizes eight core principles including minimizing human dependency, just-in-time awareness, maximum data accuracy, and embedding security into existing IT workflows. Technical flows cover automatic scanning initiation upon asset creation in NetBox, categorization against unacceptable events, and priority-based patching cycles aligned with Patch Tuesday. Self-control mechanisms and PDQL queries enable ongoing validation of subnets, asset freshness, and compliance without excessive manual oversight. The framework is designed to be adaptable to any mature vulnerability management platform beyond the specific tools demonstrated.
Google Releases Chrome 153 Fixing 230 Vulnerabilities Including Zero-Day Exploit
Google has released Chrome 153 for Windows, macOS, and Linux, addressing a total of 230 security vulnerabilities. The update includes fixes for five critical-severity issues and one confirmed zero-day vulnerability already exploited in the wild. Among the critical flaws are use-after-free bugs in WebGL tracked as CVE-2026-87464 and CVE-2026-87488, an out-of-bounds write CVE-2026-87438, a buffer overflow CVE-2026-87527, and a use-after-free in the Cast component identified as CVE-2026-87628. A medium-severity out-of-bounds write in the V8 JavaScript engine, CVE-2026-87491, was reported on August 6, 2026 and has seen active exploitation. The company is rolling out the patches gradually over the coming days and weeks across all supported platforms.
Microsoft Addresses 973 Vulnerabilities in September Security Update
Microsoft released its monthly security updates on September 8, 2026, fixing 973 vulnerabilities tracked by CVE identifiers. The release coincided with Patch Tuesday and also resolved four third-party software flaws. Affected products span Windows, Office, SQL Server, Azure, Microsoft Dynamics, SharePoint Server, and various development tools. Among the issues, 258 allow remote code execution and 438 enable privilege escalation. A total of 113 vulnerabilities received the highest severity rating of Critical, while the remaining 860 were rated Important. Several of the flaws have already been observed in active exploitation.
Microsoft Releases Record 966 Patches in Largest Patch Tuesday Ever, Including Two Actively Exploited Zero-Days
Microsoft has issued its largest monthly security update to date, addressing 966 vulnerabilities across Windows and related products during the September Patch Tuesday. The release includes two zero-day flaws already exploited in real-world attacks: CVE-2026-81963 in the Windows Update stack and CVE-2026-85880 in the Windows ALPC mechanism, both enabling local privilege escalation to SYSTEM level. A total of 105 vulnerabilities received critical severity ratings, with the majority involving privilege escalation (438) and remote code execution (258). An additional 204 issues were fixed earlier in September across Azure, Entra ID, Edge, and other services. The surge in patched flaws coincides with Microsoft's deployment of an AI-assisted vulnerability discovery system. Previous months saw significantly lower volumes, with 570 fixes in July and 400 in August.