CVE-2026-0088: In getCallingAppLabel of CertInstaller

Synopsis

This is a UI deception vulnerability in Android's CertInstaller component, specifically in the getCallingAppLabel function. An attacker with a local foothold on the device can exploit the flaw to obscure a sensitive security dialog, tricking the system into granting elevated privileges without the user's knowledge. Successful exploitation gives the attacker full local privilege escalation, enabling read, write, and disruption of data accessible to the elevated context. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to begin exploitation.

• Victim interactionNot required

  Exploitation is fully silent; no user action such as clicking a link or approving a prompt is required.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors must be aligned for the attack to succeed.

Blast Radius

• Reads sensitive data accessible to the escalated privilege context, including certificates, credentials, and protected app storage.
• Writes or modifies system-level or app-level data, enabling persistent changes such as installing rogue certificates.
• Crashes or disrupts services running under the elevated privilege level, affecting device stability.
• Gains ongoing privileged code execution on the device without any further credentials or user approval.