Which versions of Android Package Manager are affected by CVE-2026-0092?

A critical privilege escalation vulnerability in Android's Package Manager (CVE-2026-0092, CVSS 10.0) affects Android 17 devices, allowing on-device attackers to bypass device lock controls without…

How to fix or mitigate CVE-2026-0092?

24 hours: Audit all Android 17 devices in corporate inventory, BYOD programs, and managed device environments to identify exposure scope. 7 days: Implement interim compensating controls listed below and establish vendor patch monitoring workflow with Google's Android Security Bulletin. 30 days: Upon patch release, deploy to 100% of affected Android 17 devices, prioritizing devices with access to corporate applications and data.

Android Package Manager CVE-2026-0092

Q: What is the CVSS score of CVE-2026-0092?

CVE-2026-0092 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37564 CRITICAL

Missing Authorization (CWE-862)

2026-06-17 google_android

Authentication Bypass Privilege Escalation Google

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Description states local privilege escalation requiring an installed app, so AV:L and PR:L; no user interaction; full compromise of device-lock-controller-protected resources gives C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:25 vuln.today

CVE Published

Jun 17, 2026 - 06:57 cve.org

CRITICAL 10.0

DescriptionCVE.org

In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android's Package Manager allows on-device attackers to bypass the device lock controller due to a missing permission check, with no user interaction required. The flaw, disclosed in the Android Security Bulletin for Android 17, carries a vendor CVSS 4.0 score of 10.0 but is described as a local escalation. No public exploit identified at time of analysis.

Technical ContextAI

Android's Package Manager (PackageManagerService) is the system component responsible for installing, querying, and managing application packages and their associated permissions. The Device Lock Controller is a system role that enforces device-management policies - typically used by enterprise mobility management or carrier financing programs to restrict device usage. A missing permission check inside the Package Manager surface allows a caller to perform an action that should be gated behind a device-lock-controller-only permission, undermining the trust boundary between unprivileged apps and the device-management subsystem. This pattern aligns with CWE-862 (Missing Authorization).

RemediationAI

Apply the Android security patch level published in the Android 17 bulletin (https://source.android.com/docs/security/bulletin/android-17) - patch available per vendor advisory; exact SPL string should be read from that bulletin and pushed through OEM/carrier OTA channels. Until the OTA reaches devices, compensating controls include restricting sideloading via MDM (Play Protect enforced, Unknown Sources disabled), monitoring for unexpected changes to device-lock-controller state through enterprise management consoles, and avoiding installation of untrusted apps on devices enrolled in device-lock programs; the trade-off is reduced flexibility for users who legitimately install non-Play-Store apps.