A high severity local privilege escalation vulnerability in Google Android allows attackers to perform unauthorized application updates, potentially compromising system integrity.

The flaw exists within the maybeRemoveInvalidInstallerPackageName function of InstallRepository.kt, where a permissions bypass enables local escalation of privilege for an authenticated user without requiring user interaction.

Successful exploitation of this vulnerability allows a local attacker to gain elevated privileges on the target device, potentially leading to unauthorized application modifications or full system compromise. Given the CVSS score of 7.8, this flaw represents a significant risk to organizational device fleets, as it could facilitate the deployment of malicious software or bypass security controls intended to protect user data and system stability.

Immediate Action: Organizations should prioritize the deployment of the September 2026 Android security update or the latest available firmware provided by their device manufacturer.

Proactive Monitoring: Security teams should monitor system logs for suspicious package installation activity or unauthorized modifications to installed applications.

Compensating Controls: Ensure that enterprise mobile device management (MDM) policies are strictly enforced to restrict unauthorized side-loading of applications and limit the installation of non-verified packages.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to Android system integrity through potential privilege escalation. IT and security administrators must treat this as a high priority item and coordinate with mobile device vendors to ensure the latest security patches are applied across all managed assets to mitigate the risk of unauthorized application manipulation.