CVE-2026-0085: Google Android DOS Vulnerability

CVE-2026-0085 Overview

CVE-2026-0085 is an input validation vulnerability in the Android operating system. The flaw exists in the applySimpleFieldMaxSize method of DataRowHandler.java, where improper validation of contact field input allows a local actor to insert an oversized contact name. The condition can trigger a local denial of service on the affected device without requiring user interaction or elevated privileges beyond a standard local context. Google addressed the issue in the June 2026 Android Security Bulletin. The vulnerability is tracked under [CWE-20: Improper Input Validation].

Critical Impact

A local attacker can cause denial of service on affected Android devices by inserting an oversized contact name through the vulnerable applySimpleFieldMaxSize routine. No additional execution privileges or user interaction are required.

Affected Products

• Google Android 14.0
• Google Android 15.0
• Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3)

Discovery Timeline

• 2026-06-01 - Google publishes fix in the Android Security Bulletin
• 2026-06-01 - CVE-2026-0085 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-0085

Vulnerability Analysis

The vulnerability resides in applySimpleFieldMaxSize within DataRowHandler.java, a component of Android's Contacts Provider framework. The function is responsible for enforcing maximum size constraints on simple contact data fields before they are persisted. Improper validation in this routine allows a contact name to be inserted that exceeds the intended size limit. Processing the oversized field causes the affected service to enter a denial of service condition on the device.

The issue impacts confidentiality and integrity at none, but availability impact is high. Exploitation occurs locally, with low attack complexity and low privileges required. No user interaction is required, which means a malicious application already installed on the device can trigger the condition without prompting the user.

Root Cause

The root cause is improper input validation [CWE-20]. The applySimpleFieldMaxSize method does not correctly enforce the maximum permitted length for contact name fields, allowing an oversized value to be stored. When downstream components process the malformed contact entry, resource exhaustion or unhandled state leads to a denial of service.

Attack Vector

An attacker requires local access through a malicious application with permission to write contact data. The application inserts a contact record containing a name field that surpasses the intended maximum size. Because validation is incomplete, the record is accepted and propagates to dependent services, where it triggers the denial of service condition. Remote exploitation is not possible, and no user interaction is required to weaponize the flaw once the attacker controls a local application context.

The vulnerability does not provide code execution, privilege escalation, or data disclosure. Its practical impact is restricted to disrupting availability of contact-related services or the device itself.

Detection Methods for CVE-2026-0085

Indicators of Compromise

• Repeated crashes or restarts of the com.android.providers.contacts process or Contacts application.
• Application logcat entries showing exceptions originating from DataRowHandler during contact insert or update operations.
• Unexpected creation of contact records containing abnormally large name fields by non-user-initiated applications.

Detection Strategies

• Inspect device logs for anomalous failures in the Contacts Provider tied to data row handling routines.
• Audit installed applications that request WRITE_CONTACTS permission and review their behavior in mobile threat defense telemetry.
• Monitor for applications performing bulk contact insertions with atypical field sizes.

Monitoring Recommendations

• Track Android patch level (ro.build.version.security_patch) across the device fleet and flag devices below the June 2026 patch level.
• Correlate application crash telemetry with newly installed or recently updated apps that interact with contact data.
• Alert on devices reporting recurring Contacts Provider faults in mobile device management consoles.

How to Mitigate CVE-2026-0085

Immediate Actions Required

• Apply the Android security patch level dated 2026-06-01 or later to all affected devices.
• Restrict installation of untrusted applications, particularly those requesting WRITE_CONTACTS permission.
• Enforce mobile device management policies requiring devices to maintain a current security patch level.

Patch Information

Google published the fix in the Android Security Bulletin June 2026. Device manufacturers distribute the patch through OEM-specific over-the-air updates. Administrators should confirm that downstream OEMs have shipped builds incorporating the 2026-06-01 security patch level before considering devices remediated.

Workarounds

• Remove or disable third-party applications that hold WRITE_CONTACTS permission without a clear business need.
• Use mobile device management to block sideloading and restrict app installation to vetted enterprise catalogs until patches are deployed.
• Reset or clear the Contacts Provider data store if a device exhibits persistent denial of service caused by a malformed contact record.

# Verify the Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-06-01 or later