CVE-2026-0055: Android Path Traversal in PackageInstallerService Enables Local Privilege Escalation to Device Policy Controller

Technical summary

CVE-2026-0055 is a path traversal vulnerability (CWE-22) combined with improper privilege management (CWE-269) in the createSessionInternal method of PackageInstallerService.java. The flaw permits directory traversal during DPC installation, enabling an attacker to place policy controller code outside the intended installation path. This misconfiguration of access controls allows local privilege escalation without requiring special execution privileges or user interaction, making it exploitable by any local process on the device.

Business impact

This vulnerability poses a direct threat to device security posture across Android deployments. An attacker gaining local code execution—whether through a separate vulnerability or malicious app—could leverage this flaw to escalate to Device Policy Controller privileges, potentially gaining administrative control over device policies, encryption settings, and security configurations. For enterprise deployments relying on Android's MDM (Mobile Device Management) capabilities, this represents a critical chain-attack vector that could compromise both personal and corporate data.

Affected systems

The vulnerability affects Google Android across multiple versions. Organizations should verify affected version numbers against the Android security bulletin and the Android Security & Privacy Year in Review documentation. The flaw impacts all Android devices running vulnerable versions, particularly those deployed in enterprise environments where device policy controllers are actively used for mobile device management.

Exploitability

The vulnerability is locally exploitable with a CVSS score of 6.2 (Medium). The attack vector is local (AV:L), requires no special access control (AC:L), needs no privileges (PR:N), and requires no user interaction (UI:N). However, exploitation is constrained to attackers with pre-existing local code execution on the target device. While the vulnerability itself does not grant remote access, it significantly amplifies the impact of any prior local compromise by enabling privilege escalation to DPC-level control. This makes it a valuable secondary exploit for attackers who have already breached initial defenses.

Remediation

Affected organizations should prioritize applying security updates from Google when available. Since this vulnerability requires local code execution as a prerequisite, defense-in-depth strategies are essential: enforce strong app vetting policies, restrict sideloading, use runtime application self-protection (RASP) mechanisms, and deploy robust mobile threat defense solutions. Organizations should also review access logs for suspicious DPC modifications or unexpected device policy changes that might indicate exploitation attempts.

Patch guidance

Verify the availability of patches through the official Android Security & Privacy Bulletin. Apply updates to all affected Android versions as they become available from your device manufacturer or carrier. Given the medium severity rating, patch deployment should follow your standard patch management cycle, prioritized alongside any critical or high-severity updates released in the same cycle. Test patches in a controlled environment before widespread deployment, particularly if you operate Android devices in enterprise MDM scenarios.

Detection guidance

Monitor for suspicious filesystem writes in package installation directories, particularly attempts to write DPC-related code outside standard application sandboxes. Track installation attempts from unprivileged processes targeting policy controller paths. Examine device policy logs for unexpected policy controller installations or modifications. In Android enterprise environments, use MDM platforms to audit policy controller integrity and alert on unauthorized changes. Watch for patterns consistent with local privilege escalation probing, including repeated failed package installation attempts from non-system processes.

Why prioritize this

While rated MEDIUM in severity, this vulnerability deserves elevated priority in Android-heavy deployments due to its direct impact on device administrative control and the ease with which an attacker with local code execution can weaponize it. For organizations managing large Android fleets through MDM, the path to compromised device policies—and thus compromised security configurations—justifies treating this as a higher-priority patch when released. The lack of user interaction required for exploitation further reduces friction for attackers already inside the local attack surface.

Risk score, explained

The CVSS 3.1 score of 6.2 reflects a Medium severity driven by: (1) local-only attack vector limiting initial exposure, (2) no privilege requirements enabling any local process to attempt exploitation, (3) high confidentiality impact from potential access to sensitive device configurations, (4) no integrity or availability impact in the immediate vulnerability scope, and (5) unchanged security scope. The score would be significantly higher if remote exploitation were feasible. For enterprise risk scoring, consider applying organizational weights reflecting the prevalence of Android in your environment and the sensitivity of policies managed through DPC.

Frequently asked questions