CVE-2026-49887

CVE-2026-49887 is a permissions bypass in Android's package-install handling, in the maybeRemoveInvalidInstallerPackageName function of InstallRepository.kt, that permits an unauthorized app update. A malicious app already present on the device can trigger the flaw locally, with no user interaction and no additional execution privileges required. By having an app updated without proper installer authorization, an attacker can achieve local escalation of privilege with high impact on confidentiality, integrity, and availability of the device. Any device running an affected build of Android is exposed, although specific vulnerable version ranges were not provided in the available data. There is currently no evidence of exploitation: no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.1% probability of exploitation within 30 days.

What to do: Apply the latest Android security patch as soon as your device vendor or carrier distributes it (check Settings > System > System update); no workarounds are described in the available data. Because exploitation requires a local app and no user interaction, audit installed apps, especially those sideloaded or from untrusted sources, and remove unnecessary ones. No active exploitation is known, so patching as part of routine cycles is reasonable.