Google Android PackageInstallerService vulnerable to local privilege escalation

Summary

An app can update its own ownership without permission, potentially allowing it to access more data on a device. This can happen without the user's knowledge or interaction. To fix the issue, update to a version of Google Android that includes a patch for this vulnerability.

What to do

Update google platform/frameworks/base to version 16-qpr2-next:2026-03-01.
Update google platform/frameworks/base to version 15:2026-03-01.
Update google platform/frameworks/base to version 16:2026-03-01.
Update google platform/frameworks/base to version 16-qpr2:2026-03-01.
Update google platform/frameworks/base to version 14:2026-03-01.

Affected software

Vendor	Product	Affected versions	Fix available
google	android	14.0	–
google	android	15.0	–
google	android	16.0	–
google	android	16.0	–
google	android	16.0	–
google	android	16.0	–
google	platform/frameworks/base	> 16-qpr2-next:0 , <= 16-qpr2-next:2026-03-01	16-qpr2-next:2026-03-01
google	platform/frameworks/base	> 15:0 , <= 15:2026-03-01	15:2026-03-01
google	platform/frameworks/base	> 16:0 , <= 16:2026-03-01	16:2026-03-01
google	platform/frameworks/base	> 16-qpr2:0 , <= 16-qpr2:2026-03-01	16-qpr2:2026-03-01
google	platform/frameworks/base	> 14:0 , <= 14:2026-03-01	14:2026-03-01

Original title

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privil...

Original description

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvd CVSS3.1 7.8

Vulnerability type

CWE-269 Improper Privilege Management