CVE-2026-28584: PackageInstallerService DoS Vulnerability

CVE-2026-28584 Overview

CVE-2026-28584 is a logic error in the createSessionInternal method of Android's PackageInstallerService.java. A local attacker can trigger a permanent denial-of-service condition against the device without any additional execution privileges. Exploitation does not require user interaction. The flaw is tracked under [CWE-693: Protection Mechanism Failure] and was disclosed in the Android Security Bulletin for September 2026.

Critical Impact
A local, low-privileged application can permanently render an Android device unusable by abusing the package installer session creation path.

Affected Products

Android Open Source Project (AOSP) — PackageInstallerService component
Android platform builds referenced in the September 2026 Android Security Bulletin
Downstream Android distributions incorporating the vulnerable framework code

Discovery Timeline

2026-09-08 - CVE-2026-28584 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28584

Vulnerability Analysis

The defect resides in createSessionInternal within PackageInstallerService.java, the Android framework component that brokers install sessions for APKs and split packages. A logic error in the session creation path allows a caller to place the installer into a state from which the device cannot recover, producing a permanent denial of service. Because the entry point is reachable by any local app with standard install-session permissions, exploitation requires neither elevated privileges nor user interaction.

Root Cause

The root cause is a protection mechanism failure [CWE-693] in the session bookkeeping logic. createSessionInternal fails to enforce a required invariant when constructing or persisting installer sessions, allowing malformed or excessive session state to be committed. Once written, this state is reloaded on every boot, extending the impact beyond a single runtime and yielding a persistent device-level outage.

Attack Vector

Exploitation is local. A malicious application invokes the package installer session API and supplies parameters that drive createSessionInternal into the faulty branch. No user prompt, accessibility grant, or additional permission is required beyond what standard installer clients already hold. The resulting corruption of installer state prevents subsequent package management operations and can render the device unusable.

No public proof-of-concept or exploit code is available. Refer to the Android Security Bulletin September 2026 for framework-level technical detail.

Detection Methods for CVE-2026-28584

Indicators of Compromise

Repeated crashes or unresponsiveness of the system_server process tied to PackageInstaller sessions.
Persisted installer session state that survives reboot and blocks further package operations.
Unexpected creation of install sessions by non-store, non-system applications.

Detection Strategies

Review logcat entries from the PackageInstaller and PackageManager tags for anomalous createSession invocations and exceptions.
Baseline which applications legitimately create install sessions in your fleet and alert on deviations.
Correlate device reboot loops or package management failures with recently installed or updated applications.

Monitoring Recommendations

Ingest Android device logs and MDM telemetry into a central analytics platform for cross-device pattern analysis.
Track Android patch level compliance and flag devices that have not applied the September 2026 security patch level.
Monitor enterprise app catalogs for apps requesting install session APIs without a clear business need.

How to Mitigate CVE-2026-28584

Immediate Actions Required

Apply the September 2026 Android security patch level to all managed devices as soon as the OEM releases it.
Restrict sideloading and enforce install-source controls through mobile device management (MDM) policy.
Remove or block untrusted applications that request access to the package installer session APIs.

Patch Information

The fix ships as part of the Android platform update referenced in the Android Security Bulletin September 2026. Devices should be updated to the corresponding security patch level published by the OEM. AOSP downstreams should merge the upstream change to PackageInstallerService.java that hardens the createSessionInternal logic.

Workarounds

Disable installation from unknown sources on managed devices via MDM configuration.
Limit deployment of apps that hold REQUEST_INSTALL_PACKAGES to a vetted allowlist.
Where feasible, restrict user accounts on shared devices to prevent installation of arbitrary applications until the patch is deployed.

bash

# Example MDM-style policy to disable installation from unknown sources
adb shell settings put global install_non_market_apps 0
adb shell settings put secure install_non_market_apps 0