Executive brief
Android's PackageInstallerService is a core system component responsible for managing app installations on devices. A logic error in the createSessionInternal method allows attackers to permanently disable the device by triggering a denial-of-service condition without requiring special privileges or user interaction, severely impacting device usability.
Technical details
The vulnerability is a logic error in the createSessionInternal method of PackageInstallerService.java that enables a local denial-of-service attack. No special execution privileges or user interaction are required for exploitation, indicating the attacker can trigger the flaw through standard APIs or local access. The vulnerability allows an attacker to permanently disable device functionality by disrupting the app installation service, which is critical to device operation. This is a local attack surface requiring device access but no elevated permissions. Security patches addressing this issue have been released in AOSP versions for Android 14, 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched