CVE-2026-0023

Published Mar 2, 2026

Last updated 3 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-0023 is identified as a local privilege escalation vulnerability affecting the Google Android operating system. The flaw resides within the `createSessionInternal` method of `PackageInstallerService.java`, where a critical permission check is absent. This oversight allows an already installed application to modify its own package ownership without proper authorization. Exploitation of this vulnerability enables an attacker to gain elevated privileges on an affected Android device without requiring any user interaction or additional execution rights. Google released a patch for this issue in the March 2026 Android Security Bulletin, and it impacts Android versions 14.0, 15.0, and 16.0, including specific beta releases of Android 16.0. The vulnerability is categorized under CWE-269, which denotes improper privilege management.

Description
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Source
security@android.com
NVD status
Modified
Products
android

Risk scores

CVSS 3.1

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-269

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.