CVE-2026-0023: Android PackageInstallerService Local Privilege Escalation Vulnerability
Summary
CVE-2026-0023: In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. Affects platform/frameworks/base across 5 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2:0, < 16-qpr2:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android PackageInstallerService is a core component of the Android operating system responsible for managing the installation and updating of applications. It ensures that applications are installed securely and that permissions are properly enforced. However, a recent vulnerability has been identified that could allow malicious applications to exploit a missing permission check, potentially leading to unauthorized ownership updates.
Vulnerability Detail
In the createSessionInternal method of PackageInstallerService.java, there exists a flaw due to a missing permission check. This oversight allows an application to escalate its privileges locally without requiring additional execution privileges or user interaction. The vulnerability affects multiple versions of the Android framework and can lead to significant security risks, including unauthorized access to sensitive data or system resources.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit the permissions granted to applications and avoid installing untrusted apps until the framework is updated. Additionally, monitoring tools like Vulert can be utilized to keep track of vulnerabilities in open-source dependencies.
Conclusion
The CVE-2026-0023 vulnerability in the Android PackageInstallerService poses a significant risk due to its potential for local privilege escalation. It is crucial for users to update their Android framework to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-0023 is a vulnerability in the Android PackageInstallerService that allows local privilege escalation due to a missing permission check.
Exploitation of this vulnerability could allow malicious applications to gain unauthorized access to sensitive data or system resources, compromising device security.
The vulnerability affects multiple versions of the Android framework, specifically versions prior to the patches released on March 1, 2026.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, limit app permissions and avoid installing untrusted applications as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
