This vulnerability in Google Android (CVE-2026-0075) is caused by SQL injection flaws in multiple functions that handle access to the contacts database. Exploitation can lead to local elevation of privilege, enabling an attacker with limited privileges to gain higher privileges on the device. The vulnerability does not require user interaction and can be exploited locally. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed at this time, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with local access and limited privileges to escalate their privileges by exploiting SQL injection vulnerabilities in the contacts database handling functions. This can compromise the confidentiality, integrity, and availability of sensitive contact data and potentially other system components accessible with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for any suspicious activity related to contacts database access.