Multiuser Isolation Issue in Android MmsProvider by Google

CVE-2026-59005

What is CVE-2026-59005?

The Android MmsProvider has a potential multiuser isolation issue due to a missing permission check in the insertInternal method of MmsProvider.java. This vulnerability could allow local escalation of privilege, enabling malicious users to gain unauthorized access without the need for additional execution privileges. Notably, user interaction is not required for exploitation, underscoring the significance of addressing this vulnerability promptly.

References