CVE-2026-0068: Race Condition
In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure PackageInstallerService and device-owner policy require explicit Device Owner (DO) consent before allowing removal of Device Policy Controller (DPC) apps; verify the removal flow checks persistent state and DO consent prior to removing a DPC app.
PackageInstallerService / Device Owner policy require_device_owner_consent_for_removal_of_DPC_apps = enabled - Configuration
Disable installation from unknown/untrusted sources or enforce installation only from managed/verified app stores to prevent a local user from installing a malicious app that could exploit the issue.
Android installation settings allow_install_from_unknown_sources = disabled - Compensating control
Enforce enterprise app deployment and restrict app installation to administrators or via MDM/managed Play Store; block sideloading via endpoint controls or network-level filtering to reduce ability of users to install malicious apps.
- Operational
Audit and monitor package-install and package-remove events for attempts to remove the DPC app; alert administrators on unexpected DPC removals and re-provision or re-enroll affected devices immediately if a DPC is removed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0068?
The severity of CVE-2026-0068 is critical with a CVSS score of 10.
What does CVE-2026-0068 affect?
CVE-2026-0068 affects the Google Android Package Installer and can lead to local escalation of privilege.
How do I fix CVE-2026-0068?
To fix CVE-2026-0068, ensure that your Android device is updated to the latest security patch provided by Google.
What kind of attack is enabled by CVE-2026-0068?
CVE-2026-0068 enables a possible local escalation of privilege attack through the installation of a malicious app.
What is the impact of CVE-2026-0068?
The impact of CVE-2026-0068 includes the potential removal of a DPC app from a managed device without Device Owner consent due to a race condition.