CVE-2026-28587
Description
In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Summary dbcve.org
In the Android MmsSmsProvider component (MmsSmsProvider.java), a missing permission check allows any local application to query sensitive SMS and MMS data without proper authorization. This enables unauthenticated local information disclosure of message contents, timestamps, and metadata.
Mitigation
Implement and enforce proper permission checks in MmsSmsProvider to ensure only authorized applications with appropriate SMS/MMS permissions can access provider data. This typically involves adding enforceReadPermission() and enforceWritePermission() calls consistent with Android's security model.