Google Android CVE-2026-58836

Exploitation requires an attacker-controlled application to already be installed on the device via sideloading and running with ordinary User execution privileges; the attack is triggered during that app's own self-update, where the flawed handlePackagePostInstall logic lets it modify its package source to bypass Enhanced Confirmation Mode (ECM). Limiting factors: the vector is local only (AV:L)-there is no remote or network path; the attacker must first get a malicious app onto the device and executed (so it depends on sideloading being permitted and the user installing untrusted software); and it is confined to Android 16, 16-qpr2 and 17. Mitigating that exposure, no additional user interaction is needed once the app runs (UI:N). SSVC marks this not automatable, consistent with the per-device, per-app precondition.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity flaw that requires the attacker to already have code running on the device as an installed (sideloaded) application with User execution privileges - so this is not remotely reachable and not a drive-by. SSVC reinforces this reading: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (each target requires a sideloaded app to be present and run), yet Technical Impact is 'total,' matching the C:H/I:H/A:H full-privilege-escalation outcome. The signals are consistent rather than conflicting: high technical impact but constrained reachability, which is why the vuln.today decision label is 'this_week' rather than act_now/emergency. It is NOT in CISA KEV and there is no POC or EPSS score in the supplied data, so there is no evidence of active or probable near-term exploitation. Net: a real privilege-escalation bug worth patching on a normal priority cycle, not a high-CVSS-but-illusory issue, but also not an active-exploitation emergency. Missing data to note: no EPSS probability was provided, and the references point only to the Android bulletin index page rather than a per-CVE technical writeup, so trigger details beyond the description cannot be independently confirmed.

A user is tricked into sideloading a malicious app, which runs with ordinary user-level execution privileges. The app invokes a self-update and, because of the logic error in handlePackagePostInstall, modifies its own package source during that update to bypass Enhanced Confirmation Mode, escalating its effective privileges on the device. No further user interaction is required once the app is installed and running; no public exploit code was identified at time of analysis.