Android CVE-2026-0089

The attacker must already have code execution on the device as a low-privileged local app (CVSS PR:L, AV:L) running on Android 16-qpr2; no user interaction is required (UI:N). The specific prerequisite is the ability to invoke the affected functions in PackageInstallerService.java - which any installed app can reach via standard Android IPC to the package installer - without holding the permission that the missing check would normally enforce for unverified-app installation. Exploitation is limited by the need to first land an app on the device (via Play Store, sideloading, or another vulnerability) and by the affected Android version (16-qpr2); devices on older release trains or already patched to the 2026-06-01 patch level are not exploitable via this path.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally exploitable, low-complexity issue that requires only low privileges and no user interaction, yielding full CIA impact - consistent with a privilege escalation primitive on a mobile OS. There is no EPSS score, SSVC decision, or POC indicator provided, and the CVE is not listed in CISA KEV; combined, this indicates no public exploit identified at time of analysis. The realistic risk is moderate-to-high in practice: while local access is required, on Android that bar is met by any installed app, including sideloaded or Play Store apps that pivot post-install - making this a meaningful building block for malware chains rather than a remote-exposure issue.

A user installs a seemingly benign app (e.g., from a third-party store or a sideloaded APK) that requests only low-risk permissions. Once running, the app invokes the vulnerable PackageInstallerService code paths to silently install additional unverified APKs without the permission checks that would normally block this, escalating the attacker's foothold to arbitrary apps with their own privilege sets - no user prompt, no interaction.