Executive brief
Android's app installation framework contains a permissions bypass vulnerability that allows unauthorized app updates without requiring additional privileges or user interaction. An attacker with local access can exploit this to escalate privileges and take control of an Android device by forcing installation or updates of applications, potentially gaining access to sensitive device functions and user data.
Technical details
The vulnerability exists in the maybeRemoveInvalidInstallerPackageName function of InstallRepository.kt within Android's Framework component. It is a privilege escalation (EoP) vulnerability that allows an attacker to bypass normal permission checks governing app installation and updates. The attack requires only local access with no additional execution privileges needed, and user interaction is not required for exploitation. An attacker can leverage this to install, update, or modify applications outside the normal security controls, potentially executing arbitrary code or accessing sensitive permissions that would normally be restricted.
Affected products
- Google Android 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin for 2026-09-01 patch level
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue