Executive brief
A vulnerability in the Android Framework's package installation service could allow a malicious application to gain elevated system privileges. By exploiting a path traversal error, an attacker can manipulate the Device Policy Controller, which is responsible for managing enterprise security policies on the device. This could lead to unauthorized access to sensitive data or administrative control without requiring any user interaction.
Technical details
A path traversal vulnerability exists in the 'createSessionInternal' method of 'PackageInstallerService.java' within the Android Framework. The flaw allows an attacker to specify an invalid directory when updating a Device Policy Controller (DPC). This is a local escalation of privilege (EoP) vulnerability that requires no additional execution privileges or user interaction. The issue affects Android versions 14, 15, 16, and 16-qpr2. Google addressed this in the June 2026 Android Security Bulletin with security patch levels of 2026-06-05 or later.
Affected products
- Google Android Framework 14, 15, 16, 16-qpr2
Timeline
- 2026-06-01: disclosed: Vulnerability published in Android Security Bulletin and NVD
- 2026-06-05: patched: Security patch level 2026-06-05 or later addresses this issue