Executive brief
Android's Framework component contains a vulnerability in the PickActivity permission handler that allows apps to bypass the "Install unknown apps" security restriction through a confused deputy attack. This could enable unauthorized app installation without explicit user approval, potentially leading to installation of malicious software on user devices.
Technical details
This is a privilege escalation vulnerability in the Framework's setupLayout method of PickActivity.java, exploiting a confused deputy pattern where a less-privileged component is manipulated to perform privileged operations. The vulnerability allows local attackers with no additional execution privileges to bypass the "Install unknown apps" permission enforcement. No user interaction is required for exploitation. The vulnerability affects Android versions 14 through 17, with patches available in the 2026-09-05 security patch level. This is a local escalation-of-privilege (EoP) issue rather than remote code execution.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched