CVE-2026-0023: High severity Google Android vulnerability

Published Mar 2, 2026

Updated

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

6 affected components

Google Android=14.0

Google Android=15.0

Google Android=16.0

Google Android=16.0-qpr2_beta_1

Google Android=16.0-qpr2_beta_2

Google Android=16.0-qpr2_beta_3

Event History

Mar 2, 2026

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

DescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeaknessAffected Software

May 13, 58140

Event

via NVD·01:47 PM

Frequently Asked Questions

What is the severity of CVE-2026-0023?

CVE-2026-0023 has a high severity level due to the potential for local privilege escalation affecting Android versions 14.0 to 16.0.

How do I fix CVE-2026-0023?

To fix CVE-2026-0023, update your Android device to the latest security patches provided by Google.

What are the affected Android versions for CVE-2026-0023?

CVE-2026-0023 affects Google Android versions 14.0, 15.0, and 16.0, including related beta releases.

Is user interaction required to exploit CVE-2026-0023?

No, CVE-2026-0023 can be exploited without any user interaction required.

What impact does CVE-2026-0023 have on applications?

CVE-2026-0023 allows apps to update their ownership without proper permission checks, leading to potential privilege escalation.