A local privilege escalation vulnerability in the Android PackageInstallerService could allow a malicious application to gain unauthorized ownership of packages, posing a high risk to system integrity.

The flaw resides in the createSessionInternal function within PackageInstallerService.java, where a missing permission check allows an application to update its own ownership, leading to local privilege escalation without requiring user interaction.

A successful exploit grants an attacker elevated local privileges, which could be used to bypass security controls, persist on the device, or manipulate installed software. Given the CVSS score of 7.8, this vulnerability represents a significant risk to the confidentiality, integrity, and availability of data on affected Android devices.

Immediate Action: Update all affected Android devices to the version specified in the March 2026 Android Security Bulletin.

Proactive Monitoring: Monitor device logs for anomalous package installation requests or unauthorized modifications to application ownership settings.

Compensating Controls: Enforce strict application sandboxing policies and ensure that only trusted applications are installed from verified sources to minimize the attack surface.

Public Exploit Available: Unknown

This vulnerability presents a high risk for Android environments due to its potential for privilege escalation. Administrators should prioritize the deployment of the March 2026 security patches to all managed devices immediately to prevent potential exploitation.