CVE-2026-55271

Summary

The ContactsPickerActivity in Android's Contacts app has a confused deputy vulnerability (CWE-441) that allows local privilege escalation by redirecting an internal intent to an unintended target without user interaction.

Exploitability

Exploitation requires local access and no user interaction, but the attacker must already have code execution or be able to craft a malicious intent from a trusted context.

Blast radius

Successful exploitation could allow an unprivileged local attacker to read, modify, or delete contacts data, or trigger privileged operations on behalf of the Contacts app.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Android 15 Security Patch Level 2026-07 or later, as this is the earliest known fixed version for CVE-2026-55271.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.