Executive brief
A vulnerability in the Android PackageInstallerService allows for the installation of unverified applications without the necessary permission checks. This could allow a malicious actor or app already on the device to gain elevated system privileges without any user interaction. Such an exploit could lead to unauthorized data access or full control over the mobile device.
Technical details
A privilege escalation vulnerability exists in the Android Framework's PackageInstallerService.java due to missing permission checks across multiple functions. A local attacker can exploit this flaw to install unverified applications without the required authorization. The vulnerability does not require additional execution privileges or user interaction. Successful exploitation allows for local escalation of privilege (EoP) on affected Android devices. The issue is addressed in the June 2026 Android Security Bulletin for AOSP version 16-qpr2.
Affected products
- Google Android Framework 16-qpr2
Timeline
- 2026-06-01: advisory: Published in the June 2026 Android Security Bulletin
- 2026-06-01: disclosed