EUVD-2026-33800
GHSA-758m-99jr-7j44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessMalicious app installed on device
-
DeliveryApp invokes CertInstaller intent
-
ExploitgetCallingAppLabel returns misleading label
-
ExecutionSensitive trust dialog suppressed
-
PersistCredential or certificate installed silently
-
ImpactAttacker gains elevated trust privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | The attacker must already be executing code locally on the device as an installed Android app with low privileges (CVSS PR:L, AV:L) - typical for a sideloaded or Play Store-delivered malicious app on Android 14, 15, 16, or 16-qpr2. The malicious app must be able to invoke the CertInstaller component path that calls getCallingAppLabel, and exploitation succeeds without any further user interaction (UI:N) because the sensitive security dialog is hidden rather than requiring a tricked tap. Limiting factors: remote-only attackers cannot trigger this (no network vector), the device must be running an unpatched Android 14-16/16-qpr2 build pre-dating the 2026-06-01 security patch level, and stock Android sideloading restrictions plus Play Protect reduce the likelihood that a malicious app gets installed in the first place. |
| Impact | The CVSS 3.1 base score of 7.8 reflects a local attack vector (AV:L) with low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope, and high confidentiality, integrity, and availability impact - consistent with a local app-to-system privilege escalation. However, the EPSS probability is only 0.01% (1st percentile), CISA SSVC classifies Exploitation as 'none' and Automatable as 'no' (though Technical Impact is 'total'), and the issue is not in CISA KEV, indicating no observed exploitation. The CVSS description states 'User interaction is not needed for exploitation' which aligns with UI:N in the vector, but defenders should note an apparent tension: the underlying weakness is UI misrepresentation (CWE-451), which typically implies a user is present to be deceived - the no-UI requirement likely means the malicious app can suppress the dialog rather than tricking a user into clicking it. Net assessment: real but not urgent - patch on the standard Android monthly cadence rather than as an emergency. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app that holds only normal Android permissions; once running, the app invokes the CertInstaller flow and manipulates the calling-app label resolution so the trust prompt is suppressed or rendered uninformative. The certificate or credential install proceeds without a meaningful user prompt, granting the attacker the elevated trust posture (e.g., a planted CA or user key) needed to escalate beyond its sandbox. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Android 14, 15, 16, and 16-qpr2 stems from the getCallingAppLabel function in CertInstaller.java rendering a misleading or insufficient UI that can hide a sensitive security dialogue. A local low-privileged app can leverage this UI spoofing weakness (CWE-451) to obtain elevated privileges without requiring any user interaction. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.
RemediationAI
Apply the Android Security Bulletin for June 2026 by installing a build with a security patch level of 2026-06-01 or later from your device OEM, per the upstream advisory at https://source.android.com/docs/security/bulletin/2026/2026-06-01; exact AOSP fix commits and patched build identifiers should be sourced from that bulletin (patch available per vendor advisory). On managed fleets, accelerate the monthly patch ring for Android 14, 15, 16, and 16-qpr2 devices and require the 2026-06-01 patch level as a compliance baseline in MDM. Where patching is delayed, restrict sideloading by enforcing 'Install unknown apps' off via policy and require Google Play Protect to be enabled so untrusted callers cannot reach CertInstaller; note this does not stop a malicious app already installed from invoking the component, so it is a partial control with the side effect of blocking legitimate enterprise sideloading workflows.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CertInstaller is the Android system component responsible for prompting users before installing certificates, keys, and other security-sensitive credentials into the device's trust store or keystore. The getCallingAppLabel method is used to resolve and display the calling application's name within the consent dialog so users can make an informed trust decision. The CWE-451 (User Interface Misrepresentation of Critical Information) root cause indicates that the label-resolution logic can be manipulated so the security dialog is hidden, suppressed, or visually deceptive - allowing a malicious caller to trigger sensitive trust operations without the user being able to recognize or refuse them. The affected component is bundled with the Android Open Source Project as shipped on Google Android per CPE cpe:2.3:a:google:android.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A local privilege escalation vulnerability in Android 14-16 (CVE-2026-0088) allows low-privileged installed applications to elevate device permissions through UI spoofing in the CertInstaller component. With no vendor patch available and widespread distribution across Android versions, organizations deploying Android in BYOD or corporate programs face unmitigated escalation risk until a patch is released.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce app installation policies through MDM to prevent sideloading; disable 'Unknown sources' via device policy; restrict third-party app store access to managed catalogs; disable or restrict permissions for CertInstaller app where enterprise policy allows; enable continuous monitoring for privilege escalation anomalies on affected devices; isolate high-risk devices from sensitive corporate networks pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB