Android CVE-2026-49887

Exploitation requires a low-privilege Android app to already be installed and running on the target device (PR:L, AV:L); no additional privileges beyond a standard third-party app install are needed. The attacker must target a device running Android 17 or Android 16-qpr2. No user interaction is required once the malicious app is present (UI:N). Exploitation is limited by the need for prior local app installation, meaning a user must have sideloaded or otherwise installed the malicious app - whether through social engineering, a compromised app store listing, or physical device access. Devices with strict MDM policies restricting unknown-source installations are significantly less exposed. There is no confirmed exploitation condition tied to a non-default Android configuration setting beyond app presence.

The CVSS 7.8 score and the technical impact rating of 'total' from SSVC reflect the severity of full CIA compromise achievable through this bypass. However, several signals temper urgency: EPSS of 0.13% (3rd percentile) indicates very low observed exploitation probability, SSVC exploitation status is 'none', no KEV listing exists, and no public exploit code has been identified. The attack vector is local (AV:L), requiring a malicious app to already be present on the device, which significantly reduces the realistic threat surface compared to remote-exploitable flaws. The primary risk scenario is a malicious sideloaded or marketplace app that silently replaces another app - particularly a high-value target like a banking or system-adjacent app - to gain elevated code execution. SSVC 'Automatable: no' aligns with this assessment, as exploitation is conditional on local app presence. Overall this is a real but currently low-urgency finding; priority should be assigned to devices where sideloading or third-party app sources are permitted.

A threat actor distributes a malicious Android app through a third-party marketplace or social engineering campaign. Once the app is installed on a device running Android 17 or 16-qpr2, it silently invokes the installation subsystem and, by exploiting the maybeRemoveInvalidInstallerPackageName bypass, pushes a trojanized update to a target app such as a banking application or authenticator without prompting the user. The replaced app then executes attacker-controlled code under the original app's permissions and data context, enabling credential theft or further privilege escalation. No public exploit code has been identified at time of analysis.