CVE-2026-0068: Android DPC Removal Vulnerability

Technical summary

CVE-2026-0068 exists in the createSessionInternal method of PackageInstallerService.java and involves a race condition or state desynchronization (CWE-362) between in-memory session tracking and persistent storage. When a DPC app is targeted for removal, the service fails to properly validate Device Owner consent because the persistence layer and runtime state become out of sync. An unprivileged local process can exploit this window to trigger uninstallation of the DPC without the expected authorization checks. The vulnerability requires user interaction—specifically, installation of a crafted malicious app—to set the stage for exploitation.

Business impact

In enterprise and educational deployments, DPC apps are the foundation of mobile device management (MDM). Loss of DPC control allows attackers to disable encryption enforcement, disable compliance monitoring, remove remote wipe capabilities, and bypass organizational access controls. An employee or contractor with a compromised device could exfiltrate sensitive data, install malware, or become a pivot point into corporate networks. For organizations relying on Android device management for BYOD programs or fully managed scenarios, this vulnerability undermines the trust model that justifies allowing company data on personal or shared devices.

Affected systems

The vulnerability affects Google Android devices that use PackageInstallerService. The scope includes all Android versions and form factors where DPC management is deployed. Organizations using Samsung Knox, Google Workspace Device Management, Microsoft Intune for Android, or third-party MDM platforms that rely on DPC enforcement are at risk. The impact scales with the number of managed Android devices in the environment and the criticality of data stored or accessed on them.

Exploitability

Exploitation requires local access and user interaction. An attacker must convince a user to install a malicious app—a social engineering step that is well-established in real-world attack chains. Once installed, the app can exploit the race condition without further privileges. The vulnerability does not require root access, USB debugging, or developer mode, making it accessible to commodity malware distribution channels. The CVSS 3.1 score of 7.8 (HIGH) reflects the local attack vector, required user interaction, but significant impact on confidentiality, integrity, and availability of the device's security posture.

Remediation

Patch deployment is the primary mitigation. Organizations should prioritize updates to the latest Android security patch level. Interim controls include restricting app installation sources to managed Google Play or enterprise app stores, enforcing app signature verification, and deploying application allowlisting to prevent installation of untrusted apps. Device policy controls should be audited to ensure DPC apps remain in place; monitor for unexpected removal of security agents. User awareness training is essential to reduce the likelihood of users installing malicious apps.

Patch guidance

Wait for vendor (Google) to release a patched Android security update. Check the Google Security & Privacy Blog and Android Security & Privacy Bulletin for the affected Android version and patch availability. Apply patches through your MDM platform's staged deployment process, beginning with non-production or lower-risk device cohorts. Verify that DPC apps remain active and functional post-patch. For devices that cannot be patched within your organizational timeline, consider restricting their access to sensitive corporate resources until a patch is applied.

Detection guidance

Monitor for unexpected removal of DPC apps on managed devices using MDM reporting features. Implement alerts within your MDM platform if any managed device reports loss of compliance or removal of the Device Policy Controller. Check device logs for PackageInstallerService errors or abnormal app uninstallation events. Correlate DPC removal events with recent app installations to identify potential malware distribution. Test your detection by simulating DPC removal in a lab environment to calibrate alerting thresholds.

Why prioritize this

This vulnerability directly undermines device management control in enterprise environments. It enables a local, unprivileged attacker to bypass organizational security policies by removing the enforcement mechanism. User interaction is the only barrier, and malware distribution is a routine threat vector. Any organization managing Android devices for work should prioritize patching. The HIGH CVSS score and the strategic importance of DPC in mobile security governance elevate this to critical-or-high priority depending on your organization's Android deployment size and data sensitivity.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is justified by the combination of: (1) Low attack complexity and no special privileges required, (2) Required but plausible user interaction (app installation), (3) High impact on confidentiality, integrity, and availability of device security controls. The score does not account for business context—enterprises managing sensitive data on Android may assess internal risk as critical. The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not been widely documented at publication, but this does not reduce its severity in managed environments.

Frequently asked questions