EUVD-2026-37561Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconLure user on managed device
-
DeliveryUser sideloads malicious app
-
ExploitApp opens PackageInstaller session
-
InstallTrigger createSessionInternal desync
-
C2Persisted state bypasses DO consent check
-
ExecuteDPC silently removed
-
ImpactDevice falls out of MDM management
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The device must be enrolled in an Android Enterprise managed configuration with a Device Owner DPC installed (otherwise there is nothing to remove), and the victim user must install and run an attacker-supplied app on that device - meaning sideloading or installation from a non-vetted source must be permitted by policy. User interaction is explicitly required per the description, so silent exploitation is not possible; no elevated privileges or special permissions are needed beyond ordinary app installation. Devices without an active DPC, or fleets that block unknown-source installs via DevicePolicyManager, are not exploitable. |
| Impact | Signals conflict and should be reconciled. The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H and SC/SI/SA:H, scoring 10.0) is inconsistent with the prose description, which clearly states 'local escalation of privilege' and 'a user can install a malicious app' with 'User interaction is needed'. A locally installed app is AV:L, and required user interaction is UI:P/UI:A - the vendor-style description points to a far lower realistic score than 10.0. The real risk is meaningful but narrow: an attacker must convince a user on a managed device to sideload a malicious app, after which DPC removal becomes possible. There is no KEV listing, no published POC, and EPSS data was not provided, so this is best treated as a managed-fleet integrity issue rather than mass-exploitable RCE. MDM/EMM operators should prioritize, general consumer-device risk is lower. |
| Exploit ScenarioDerived | An attacker publishes a malicious app (e.g., a repackaged utility on a third-party store) and social-engineers an employee with a corporate-managed Android device into installing it. On launch, the app abuses the createSessionInternal desync to issue an uninstall session targeting the enterprise DPC package; because the persisted state is out of sync with the policy check, the uninstall succeeds without Device Owner consent, leaving the device unmanaged and free of MDM controls. No public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Local privilege escalation in Android's PackageInstallerService allows a malicious app to remove a Device Policy Controller (DPC) from a managed device without Device Owner consent, breaking the enterprise management boundary. The flaw stems from a desynchronization between in-memory state and persisted state in createSessionInternal, and no public exploit has been identified at time of analysis. User interaction is required, but no additional execution privileges are needed beyond installing the malicious app.
RemediationAI
Patch available per vendor advisory - apply the Android security patch level published in the June 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/android-17) once it is offered by your device OEM, and ensure managed-fleet devices are pinned to that or a later SPL via MDM compliance policy. As a compensating control before patching, restrict sideloading on managed devices by disabling 'Install unknown apps' for all sources via DevicePolicyManager and enforce Play Protect / managed Google Play as the sole install channel; the trade-off is reduced flexibility for users who legitimately install enterprise-signed APKs outside managed Play. Additionally, monitor MDM telemetry for unexpected DPC removal or 'device unmanaged' events, since exploitation manifests as the DPC silently disappearing from a previously enrolled device.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in PackageInstallerService.java, the core Android service that brokers all package install/uninstall sessions across Google Android (cpe:2.3:a:google:android). createSessionInternal is the entry point that constructs an InstallSession used by PackageInstaller clients. According to the description, the in-memory session state diverges from the on-disk persisted state ('desync from persistence'), which is a state-management / TOCTOU-class weakness (no specific CWE was published, but the behavior is consistent with CWE-367/CWE-372 race or stale-state checks). The practical consequence is that uninstall logic which should be gated by Device Owner (DO) approval can be applied to the DPC package itself, defeating the management model that Android Enterprise relies on.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Local app install vector (AV:L), explicit user interaction required (UI:R), no prior privileges (PR:N); DPC removal crosses the management security authority so S:C with full C/I/A impact on the managed device.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
DescriptionCVE.org
In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution privileges needed. User interaction is needed for exploitation.
Executive ViewAI
Android's PackageInstallerService vulnerability allows malicious applications to remove Device Policy Controllers (DPC) from enterprise-managed devices, disabling organizational Mobile Device Management (MDM) controls; no public exploit has been identified at time of analysis. This affects all Android devices in managed deployments, potentially exposing regulated organizations to compliance violations and uncontrolled data loss. The vulnerability is critical for regulated industries where MDM is essential for enforcing security policies and protecting sensitive mobile data.
No vendor-released patch identified at time of analysis. Interim mitigations: Enforce app installation restrictions through MDM to only approved applications; restrict installation of apps from unknown sources; implement detective controls and real-time monitoring for Device Policy Controller removal attempts; reduce sensitive data provisioning to affected Android devices; implement network segmentation and additional device monitoring for endpoints with compromised MDM controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
GitHub PoC
Exploit-DB