Executive brief
A logic error in the Android system's update component (apexd) allows a local attacker to block critical security updates. By preventing these updates, an attacker can keep a device vulnerable to known security flaws, potentially leading to a full takeover of the device. This issue does not require any special user interaction to exploit.
Technical details
A logic error exists within the 'VerifyNoOverlapInSessions' function in 'apexd.cpp', the daemon responsible for managing APEX packages (Android Pony EXpress) on Android. An attacker can exploit this flaw to interfere with the installation of mainline security updates. The vulnerability is categorized as an Improper Check for Unusual or Exceptional Conditions (CWE-754). Successful exploitation allows for local escalation of privilege (EoP) without requiring additional execution privileges or user interaction. Google has addressed this in the June 2026 Android Security Bulletin for Android version 16.
Affected products
- Google Android 16
Timeline
- 2025-09-04: disclosed
- 2025-09-04: advisory: Initial NVD publication
- 2026-06-01: patched: Security patch level 2026-06-05 or later address this issue