CVE-2026-49887: Android InstallRepository Privilege Escalation

CVE-2026-49887 Overview

CVE-2026-49887 is a local privilege escalation vulnerability in the Android platform's package installer component. The flaw resides in the maybeRemoveInvalidInstallerPackageName function of InstallRepository.kt. A permissions bypass in this routine allows a local application to perform unauthorized app updates without holding the required installer privileges. Exploitation requires no user interaction and no additional execution privileges beyond those already available to a local low-privileged app. The issue is tracked in the Android Security Bulletin published on September 1, 2026, and is categorized under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
A local application can silently update installed packages, replacing legitimate apps with attacker-controlled versions and escalating privileges on the device.

Affected Products

Android platform (InstallRepository.kt component of the package installer)
Devices receiving Android Security Bulletin patch level prior to 2026-09-01
OEM Android distributions incorporating the affected package installer code

Discovery Timeline

2026-09-01 - Android Security Bulletin published addressing the issue
2026-09-08 - CVE-2026-49887 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-49887

Vulnerability Analysis

The vulnerability exists within maybeRemoveInvalidInstallerPackageName, a function responsible for validating the installer package identity supplied during an install session. The routine is intended to strip or reject installer package names that the calling app is not authorized to claim. A logic defect in this validation permits a local app to influence the installer identity used by the package installer, effectively bypassing the permission checks that gate app updates. Once the check is circumvented, the attacker's application can trigger the update path for another installed package. This yields local privilege escalation because the replacement package can inherit or supersede the trust and permissions granted to the original app.

Root Cause

The root cause is an authentication bypass via an alternate path [CWE-288] inside the installer package name sanitization logic. The function fails to consistently enforce that only privileged installer components can assert an installer identity for an existing package. As a result, permission enforcement for INSTALL_PACKAGES and related update authorization is short-circuited during specific session states.

Attack Vector

Exploitation is local. A malicious app installed on the device invokes the package installer APIs with crafted session parameters that reach the vulnerable code path in InstallRepository.kt. No user prompt, consent dialog, or additional privilege grant is required. The attacker then submits an update APK for a targeted package, achieving unauthorized replacement and privilege escalation. Because user interaction is not needed, the flaw is well suited for chaining with an initial-access dropper or supply-chain implant.

No public proof-of-concept has been released. The vulnerability is described in the Android Security Bulletin September 2026.

Detection Methods for CVE-2026-49887

Indicators of Compromise

Unexpected changes to the installerPackageName attribute of installed applications, observable via pm list packages -i.
Package updates that occur without user consent dialogs or Play Store activity in device logs.
Install sessions created by non-privileged apps that target already-installed package names.

Detection Strategies

Audit mobile device management (MDM) inventory feeds for silent version changes on sensitive apps between check-ins.
Correlate PackageInstaller session events in logcat with the UID of the initiating process to flag non-store installers updating third-party packages.
Alert on installations where the reported installer package does not match the enrolled app store or enterprise installer.

Monitoring Recommendations

Enroll devices in an MDM or mobile threat defense solution that tracks package install provenance and patch level.
Enforce Android security patch level reporting and block devices below the 2026-09-01 patch level from accessing sensitive resources.
Monitor enterprise app catalogs for hash drift on managed applications and quarantine devices exhibiting unauthorized updates.

How to Mitigate CVE-2026-49887

Immediate Actions Required

Apply the Android security patch level 2026-09-01 or later on all managed devices.
Contact OEM and carrier vendors to confirm patch availability for device models that lag the upstream bulletin.
Restrict installation of applications from unknown sources through MDM policy across the fleet.
Review installed applications for unexpected installer package attributions and remove untrusted apps.

Patch Information

Google addressed the vulnerability in the September 2026 Android Security Bulletin. Details, source patches, and the list of affected components are available in the Android Security Bulletin September 2026. Device manufacturers integrate the fix into their monthly patch train, so verify the exact build fingerprint published by the OEM.

Workarounds

Disable the "Install unknown apps" permission for all non-essential applications until the patch is deployed.
Enforce Google Play Protect scanning and require devices to remain enrolled in Play Protect.
Use enterprise mobility management to constrain which apps may hold the REQUEST_INSTALL_PACKAGES permission.

bash

# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch

# List installed packages along with their reported installer package name
adb shell pm list packages -i | grep -v "com.android.vending\|com.google.android.packageinstaller"