CVE-2026-0089: High severity Google Android PackageInstallerService vulnerability

Published Jun 1, 2026

Updated

In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

4 affected components

Google Android PackageInstallerService

Google Android=16.0-qpr2_beta_1

Google Android=16.0-qpr2_beta_2

Google Android=16.0-qpr2_beta_3

Event History

Jun 1, 2026

CVE Published

via MITRE·09:14 PM

Data Sourced

via MITRE·09:14 PM

DescriptionWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0089?

The severity of CVE-2026-0089 is high, with a CVSS score of 7.8.

How do I fix CVE-2026-0089?

To fix CVE-2026-0089, ensure that all software is updated to the latest version provided by Google that includes the necessary permission checks.

What systems are affected by CVE-2026-0089?

CVE-2026-0089 affects systems running Google Android and specifically the Google Android PackageInstallerService.

What type of vulnerability is CVE-2026-0089?

CVE-2026-0089 is a local escalation of privilege vulnerability due to a missing permission check.

Is user interaction required for exploiting CVE-2026-0089?

No, user interaction is not required for exploiting CVE-2026-0089.