Heise.De Google Restricts Contact Access in Android 18 to Prevent Exploits
Article Content
- •Android 18 restricts WRITE_CONTACTS permission to enhance security.
- •Apps must use specific intents for contact modifications without permissions.
- •New MANAGE_CONTACTS permission will be available for select apps in Android 17 QPR2.
Google's Android 18 update, released on October 28, 2026, restricts apps from using the WRITE_CONTACTS permission to edit contacts in the background. Instead, developers must utilize intents like ACTION_INSERT, ACTION_EDIT, and ACTION_INSERT_OR_EDIT, which do not require permissions. This change aims to mitigate risks of fraudulent apps manipulating contact data without user consent. A new permission, MANAGE_CONTACTS, will be introduced in Android 17 QPR2 for apps needing broader access. The update is part of Google's ongoing efforts to enhance user privacy and security. Developers are advised to review the new guidelines and migration steps provided by Google. The final version of Android 18 is expected to be released in June 2027.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Common questions
What changes does Android 18 introduce?
When will the final version of Android 18 be released?
What should developers do to comply with the new guidelines?
Continue Reading
China-linked Hackers Exploit PHP2Shell to Compromise 25 Firewalls A China-linked threat actor has exploited vulnerabilities in PHP2Shell (CVE-2026-109618, CVE-2026-109619) and the Fragnesia privilege escalation bug (CVE-2026-46300) to gain root access to 25 firewalls, including those in an U.S. The attackers identified vulnerable systems using the FOFA search engine and executed…
Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026…