Google Android CVE-2026-0055

The attacker must have local access to an Android 14, 15, 16-qpr2, or 16 device, achieved via a locally installed application (sideloaded or obtained through an app store) that calls the PackageInstallerService API. No special Android permissions beyond those available to ordinary unprivileged applications are required per the CVSS PR:N rating, and no user interaction is required after the malicious app is installed (UI:N). The critical limiting factor is that exploitation targets the Device Policy Controller installation pathway: the attack is most impactful on enterprise-managed devices where a DPC is actively deployed and enforcing policy. Consumer devices without an active MDM profile or DPC installation have reduced practical impact, though the path traversal flaw exists in the codebase regardless. Remote exploitation over a network is not possible due to the local attack vector (AV:L).

The CVSS 3.1 score of 6.2 (Medium) reflects a local attack vector (AV:L), no privileges required (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N). A notable inconsistency exists: the description characterizes the outcome as local escalation of privilege, yet the CVSS scoring records C:H with I:N - privilege escalation would typically manifest as integrity impact. Security teams should verify with Google whether the full privilege escalation impact is captured in this scoring or whether C:H reflects a specific data-access consequence. EPSS at 0.01% (1st percentile) signals negligible observed exploitation probability. This vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified, confirming it is not a current mass-exploitation priority. The local access requirement (AV:L) is the primary risk mitigator - exploitation requires a co-located malicious application or physical device access, ruling out remote attack scenarios.

An attacker distributes or socially engineers installation of an unprivileged application on a target Android 14-16 device. The malicious application invokes createSessionInternal with a crafted session directory parameter containing path traversal sequences, causing PackageInstallerService to place or update a Device Policy Controller in an unintended filesystem location. This bypasses the DPC's policy enforcement boundary, allowing the attacker to access confidential data protected under the DPC's authority. No public proof-of-concept code has been identified at time of analysis.