CVE-2026-0088: CertInstaller Package Local Privilege Escalation Vulnerability
Summary
CVE-2026-0088: In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading or insufficient UI. Affects platform/packages/apps/CertInstaller across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CertInstaller package is an essential component of the Android operating system, responsible for managing and installing security certificates. It plays a critical role in ensuring secure communications and data integrity by allowing users to install trusted certificates. However, due to a design flaw, it is susceptible to a local privilege escalation vulnerability that can be exploited without requiring additional execution privileges.
Vulnerability Detail
In the CertInstaller.java file, specifically in the getCallingAppLabel method, there exists a flaw that can mislead users by hiding sensitive security dialogues. This misleading UI can allow an attacker to escalate privileges locally, potentially compromising the security of the device. The vulnerability does not require user interaction for exploitation, making it particularly dangerous.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The CVE-2026-0088 vulnerability in the CertInstaller package poses a serious risk of local privilege escalation due to misleading UI elements. Users are strongly advised to update to the patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform/packages/apps/CertInstaller →
FAQ
CVE-2026-0088 is a vulnerability in the CertInstaller package that allows local privilege escalation due to misleading UI in the security dialogue.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Exploitation of this vulnerability can lead to unauthorized privilege escalation, potentially compromising the security of the device and its data.
No, user interaction is not needed for exploitation, making it a significant security risk.
You can update the CertInstaller package by downloading the patched version from the official Android source repository using the provided links.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/CertInstaller.
