CVE-2026-0068: In createSessionInternal of PackageInstallerService

Synopsis

This is a privilege escalation vulnerability in Android 17's PackageInstallerService, specifically in the createSessionInternal method. A desynchronization between runtime state and persisted state allows a malicious app to remove a Device Policy Controller (DPC) app from a managed device without the Device Owner's consent, then escalate privileges in the resulting unmanaged context. Successful exploitation gives an attacker elevated local privileges on the device. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Google publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to a remote service is required to trigger the vulnerability.

• AuthenticationNot required

  No account credentials or system privileges are required before exploitation begins; any process able to initiate a package installer session is sufficient.

• Victim interactionRequired

  A user must take an action, such as installing or approving a malicious app, for the exploit to proceed.

• Attack complexityDetail

  The exploit is reliable and condition-free once the malicious app is present; no race conditions or special environmental factors need to be arranged.

Blast Radius

• Attacker removes the Device Policy Controller app from a managed Android 17 device, stripping enterprise management controls without administrator consent.
• With the DPC removed, the attacker gains elevated local privileges, bypassing device policy enforcement such as screen lock, encryption mandates, and app allowlists.
• All three pillars of the managed device are affected: confidential data stored under DPC-enforced policies becomes readable, device configuration becomes writable, and the management channel itself is severed, disrupting IT oversight.
• Compromise extends to resources accessible through the now-unmanaged device, including corporate credentials cached on the device and any network resources the device was authorized to reach.