CVE-2026-0023: 
NixOS vulnerability analysis and mitigation

CVE-2026-0023 is a local privilege escalation vulnerability in Android's PackageInstallerService.java that allows a low-privileged app to update its ownership due to a missing permission check in the createSessionInternal method. It affects Google Android versions 14.0, 15.0, and 16.0 (including QPR2 beta variants). The vulnerability was published on March 2, 2026, with a patch included in the Android March 2026 security bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (Android Security Bulletin, Red Hat CVE).

The root cause is a missing authorization check (CWE-862) combined with improper privilege management (CWE-269) in the createSessionInternal method of PackageInstallerService.java. An installed app with low privileges can invoke this method to update the ownership of an installation session without the required permission validation, effectively hijacking or assuming control of another app's installer session. The attack vector is local, requires only low privileges, has low attack complexity, and requires no user interaction. No public proof-of-concept code has been identified at this time (Android Security Bulletin, Feedly Intelligence).

Successful exploitation allows a local, low-privileged application to escalate its privileges on the affected Android device, gaining high-impact access to confidentiality, integrity, and availability of system resources. An attacker could leverage this to install or modify applications outside of normal permission boundaries, potentially enabling persistence, data theft, or further compromise of the device. The scope is limited to the affected device (no scope change), but the elevated access could facilitate lateral movement within the device's application ecosystem (Android Security Bulletin).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly Intelligence, Android Security Bulletin).

1. Reconnaissance: Identify a target Android device running version 14.0, 15.0, or 16.0 that has not applied the March 2026 security patch level (2026-03-01 or later).
2. Malicious App Installation: Install a low-privileged malicious application on the target device, either via sideloading or through a social engineering vector.
3. Invoke Vulnerable Method: From within the malicious app, call the createSessionInternal method in PackageInstallerService with crafted parameters designed to claim or update ownership of an existing installation session belonging to another app or a privileged installer.
4. Bypass Permission Check: Due to the missing authorization check, the system does not validate whether the calling app has the right to modify session ownership, allowing the operation to succeed.
5. Privilege Escalation: With elevated ownership of the installer session, the malicious app can perform privileged package installation or modification actions, effectively escalating its privileges on the device without requiring additional permissions or user interaction (Android Security Bulletin).

• Logs: Android system logs (logcat) showing unexpected calls to PackageInstallerService.createSessionInternal from low-privileged or unknown applications; anomalous session ownership changes in package installer logs.
• File System: Unexpected APK installations or modifications to installed packages not initiated by the device owner or a trusted installer.
• Process/Behavior: Applications performing package installation operations without user-visible prompts or without holding expected installer permissions; unusual PackageInstaller session activity from third-party apps.

Google released a patch addressing CVE-2026-0023 in the Android Security Bulletin for March 2026 (patch level 2026-03-01). Users and administrators should update affected Android devices (versions 14.0, 15.0, and 16.0) to the patched security patch level as soon as OEM updates are available. As a general precaution, limit installation of apps from untrusted sources and review app permissions regularly. No configuration-based workaround has been published (Android Security Bulletin, CIS Advisory).

The CIS (Center for Internet Security) issued an advisory covering multiple vulnerabilities in the March 2026 Android OS update, including CVE-2026-0023, noting the potential for privilege escalation (CIS Advisory). Security aggregators such as VulnDB, CVEFeed, and Infinit Security published brief write-ups shortly after disclosure. Community reaction has been measured, consistent with the absence of public exploit code or active exploitation.