CVE-2026-0089: In multiple functions of PackageInstallerService

Synopsis

This is a missing permission check vulnerability in Android's PackageInstallerService component, affecting Android 16-QPR2. An attacker with a low-privilege local account can exploit it without any user interaction, bypassing app verification to install unverified applications. Successful exploitation gives the attacker full local privilege escalation, gaining high-level read, write, and execution control over the affected device. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  The attacker can exploit this vulnerability entirely on their own without requiring any action from another user.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions or specific environmental layout to succeed.

Blast Radius

• Installs arbitrary unverified applications onto the device, bypassing the platform's app verification controls.
• Gains full read access to sensitive data on the device, including files, credentials, and application data.
• Gains write and modify access to system state, persisted data, and application configurations.
• Achieves full local privilege escalation, enabling arbitrary code execution at an elevated privilege level.