Cross-User Data Leak in ProviderUtil.java of Android Systems

CVE-2026-58976

What is CVE-2026-58976?

A vulnerability exists in the getSelectionBySubIds method of ProviderUtil.java within Android systems, allowing for a potential cross-user data leak. This issue arises from a logic error in the implementation, enabling local information disclosure without requiring any additional execution privileges. The vulnerability can be exploited without user interaction, posing a risk to data privacy in impacted Android systems.

References