CVE-2026-28587: Google Android Information Disclosure Flaw

CVE-2026-28587 Overview

CVE-2026-28587 is an information disclosure vulnerability in the MmsSmsProvider component of Google Android. The flaw exists in MmsSmsProvider.java, where a missing permission check allows unauthorized access to sensitive SMS and MMS data. Local applications can retrieve protected information without holding the required permissions. Exploitation requires no user interaction and no elevated privileges. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Any installed application on an affected Android device can read sensitive SMS/MMS content without permission prompts or user awareness.

Affected Products

Google Android 17.0
Devices running unpatched Android 17 builds
OEM distributions that have not merged the Android Security Bulletin #17 patches

Discovery Timeline

2026-06-17 - CVE-2026-28587 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-28587

Vulnerability Analysis

The MmsSmsProvider is an Android ContentProvider that exposes URIs for SMS and MMS message data. Content providers in Android must enforce permission checks on query(), insert(), update(), and delete() operations to prevent unauthorized data access. In the affected build, one or more code paths in MmsSmsProvider.java fail to call the appropriate permission enforcement routine before returning data. As a result, a local application can issue a content query and receive sensitive message data without holding READ_SMS or equivalent permissions.

The vulnerability is local in scope despite the network attack vector in the CVSS metric. Exploitation occurs through standard Android inter-process communication using the ContentResolver API. No memory corruption, race condition, or user interaction is involved.

Root Cause

The root cause is an omitted authorization check ([CWE-862]) within one or more content provider entry points in MmsSmsProvider.java. The provider returns rows from the SMS/MMS database without first validating that the calling UID holds the required permission declared in the platform manifest.

Attack Vector

A malicious or curious application installed on the device queries the affected content:// URI exposed by MmsSmsProvider. Because no permission gate is enforced on the vulnerable path, the system returns SMS or MMS records to the caller. The technique can be embedded in any sideloaded app, repackaged app, or app distributed through unvetted channels. See the Android Security Bulletin #17 for component-specific technical details.

Detection Methods for CVE-2026-28587

Indicators of Compromise

Unexpected ContentResolver.query() calls targeting MmsSmsProvider URIs from applications without READ_SMS declared in their manifest
Applications transmitting SMS-like data over the network shortly after installation
Logcat entries showing access to content://mms-sms/ paths from non-messaging apps

Detection Strategies

Audit installed application manifests for missing SMS-related permissions paired with observed message-data network exfiltration
Use Android enterprise telemetry to flag apps invoking content URIs inconsistent with their declared functionality
Review mobile threat defense logs for anomalous content provider access patterns on Android 17 devices

Monitoring Recommendations

Enroll Android 17 devices in mobile device management with telemetry forwarding to a centralized analytics platform
Forward Android system and application logs into a security data lake for behavioral correlation across the fleet
Monitor application install events on managed devices and correlate against known-good app inventories

How to Mitigate CVE-2026-28587

Immediate Actions Required

Apply the Android Security Bulletin #17 patch to all managed Android 17 devices as soon as the OEM build is available
Restrict installation of applications from unknown sources through mobile device management policy
Inventory devices running Android 17 and prioritize patch rollout to executives and high-value users

Patch Information

Google has addressed CVE-2026-28587 in the Android 17 security patch level referenced in the Android Security Bulletin #17. Device manufacturers must integrate the upstream fix and ship it through their respective OTA channels. Verify the patch level on each device using Settings > About phone > Android security update.

Workarounds

Limit app installations to vetted enterprise app stores or Google Play until patches are deployed
Remove or disable non-essential applications on Android 17 devices that handle sensitive communications
Educate users to avoid sideloading APKs from untrusted sources during the patch window

bash

# Verify Android security patch level on a managed device via adb
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release