CVE-2026-28575: In PackageInstaller

Synopsis

A memory exhaustion vulnerability exists in the Android PackageInstaller component, specifically in the PackageInstaller.Session#transfer method. The flaw is caused by a logic error that allows an attacker to trigger unbounded memory consumption on the device, requiring no privileges and no user interaction. Successful exploitation causes a local denial of service, crashing or hanging the affected service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The vulnerability is exploited locally; the attacker needs an existing shell or process on the host, with no over-the-network access required.

• AuthenticationNot required

  No privileges are required; any process running on the device can trigger the memory exhaustion without holding any account credentials or elevated permissions.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the fault entirely from their own process without prompting or involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no specific race conditions, memory layout dependencies, or other environmental prerequisites.

Blast Radius

• Crashes or hangs the PackageInstaller service, preventing any application installation or update operations on the affected device.
• Sustained memory exhaustion can trigger system-wide low-memory conditions, causing the Android OS to kill unrelated foreground and background processes.
• Persistent exploitation can render the device unresponsive, effectively producing a hard denial-of-service until the device is rebooted.
• In environments where Android system components are bundled into container images (for example, emulator or CI pipeline images), the host workload running that image becomes unavailable for the duration of the attack.