PoC Exploit Released for Android CVE-2026-0075 Allowing Contact Theft Without READ_CONTACTS Permission
A researcher has published a proof-of-concept exploit for vulnerability CVE-2026-0075 in Android. The flaw resided in the system component ContactsProvider2 and allowed a local application to reach the contacts database via SQL injection even when the user had never granted the READ_CONTACTS permission.
No additional user interaction or confirmation dialogs were required. The vulnerability stemmed from overly verbose SQLite error messages returned by ContactsProvider2 when specially crafted queries triggered database errors. By analyzing these responses, an application without any contact permissions could gradually reconstruct entries from the contacts database.
Google assigned the issue a high severity rating. It affects Android 14, Android 15, Android 16 and Android 16 QPR2, according to the June 2026 Android security bulletin. The official patch removes detailed JSON error information from responses sent to applications lacking contact access rights, replacing it with a generic message.
The PoC exploit published on GitHub intentionally does not request READ_CONTACTS or WRITE_CONTACTS permissions. Its author designed it for controlled laboratory testing to compare the behavior of patched and vulnerable builds. The researcher notes that a successful test on one device does not prove the vulnerability exists on every smartphone running the same Android version.
No confirmed cases of real-world exploitation of CVE-2026-0075 have been observed so far. However, the availability of public exploit code makes it unrealistic to expect older, unpatched firmware to remain safe. Users should check their device security update level in settings and ensure installation of the patch dated 5 June 2026 or newer.
Related articles
Oracle Releases August 2026 Monthly Security Patches Fixing 943 Vulnerabilities
Oracle has published its monthly Critical Security Patch Update on August 18, 2026, addressing a total of 943 vulnerabilities across a wide range of products. This release supplements the company's quarterly Critical Patch Update and includes fixes for third-party software issues, resulting in 925 unique CVEs after removing duplicates. Of these, 710 vulnerabilities received CVSSv3 base scores of 7.0 or higher, with 154 scoring 9.0 or above, including three at the maximum 10.0. A total of 467 flaws can be exploited remotely without authentication. Major products affected include Oracle Fusion Middleware with 262 patches, Oracle E-Business Suite with 120 fixes, and Oracle Database Server with six updates. The next monthly update is scheduled for September 15, 2026, followed by the quarterly release on October 20.
Critical Authentication Bypass and Buffer Overflow Flaws Patched in NetScaler ADC and Gateway
Cloud Software Group disclosed two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway products. CVE-2026-19490 permits authentication bypass via an alternate path when the appliances operate as SSL VPN, ICA proxy, CVPN, or RDP proxy gateways, or when configured as authentication, authorization, and auditing virtual servers. CVE-2026-19489 is a buffer overflow in LSN groups with SIP ALG enabled that can lead to unexpected behavior or denial of service. Both issues received CVSS v4.0 base scores of 9.3 and 8.8 respectively. Fixed builds 14.1-73.32 and 13.1-63.21 are now available along with corresponding FIPS and NDcPP updates.
Microsoft Releases Fix for Windows Defender Crashes During Quick and Full Scans
Microsoft has issued a security intelligence update to resolve a crash in Windows Defender that occurred during quick or full system scans on affected Windows 10 and Windows 11 devices. The bug, introduced after a recent set of patches, caused the antivirus service to terminate unexpectedly with the message "Threat service has stopped. Restart it" and access violation error 0xc0000005. Some users misinterpreted the repeated failures as malware infection or severe system damage, leading them to reinstall Windows entirely. Administrators were able to reproduce the issue consistently across multiple machines simply by initiating a quick scan, confirming the root cause lay in Defender itself rather than individual endpoints. The fix is included in security intelligence version 1.457.236.0 and all subsequent releases, with Microsoft advising users to ensure automatic updates are applied via Windows Update or manually through the Windows Security interface.
Critical Vulnerability in Forminator Forms WordPress Plugin Enables Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2026-15748 with a CVSS score of 9.8 has been identified in the Forminator Forms plugin for WordPress. The flaw allows unauthenticated attackers to upload malicious PHP files by manipulating the Select field alongside a File Upload field on published forms. This bypasses extension blocking and file type validation, potentially leading to full server compromise including web shell installation and database access. The plugin, which has more than 600,000 active installations, is affected in all versions up to and including 1.56.1. The issue was resolved in version 1.56.2 released at the end of July, with later updates including 1.57.0 now available.