CVE-2026-0092: In Package Manager, there is a possible device lock controller bypass due to a missing permission check

Synopsis

This is an authentication bypass (missing permission check) in the Android Package Manager component affecting Android 17. The vulnerability is reachable over the network with no authentication required and requires no victim interaction, allowing an attacker to bypass the device lock controller and escalate privileges locally. Successful exploitation gives the attacker full control over the device, including read and write access to protected data and the ability to disrupt services. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is exploitable over the network (AV:N), meaning an attacker must be able to reach the affected service across a network connection.

• AuthenticationNot required

  No credentials or prior account access are needed (PR:N); an unauthenticated attacker can trigger the missing permission check directly.

• Victim interactionNot required

  Exploitation is fully silent and requires no action from a user on the affected device (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, memory layout, or other environmental prerequisites.

Blast Radius

• A successful attacker bypasses the device lock controller and escalates to full local privilege, gaining unrestricted control over the Android 17 environment.
• The attacker can read any data stored on the device, including protected app data, credentials, and session tokens (VC:H).
• The attacker can write or delete any data, install or remove packages, and modify system configuration without restriction (VI:H, SI:H).
• The attacker can crash or disable services on the device and affect dependent downstream systems, causing full availability loss (VA:H, SA:H).