Medium severity6.7NVD Advisory· Published Mar 11, 2024· Updated Jun 17, 2026

CVE-2024-0044

Description

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Google/Androidllm-fuzzy6 versions
(expand)+ 5 more
- (no CPE)
- cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:12.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
- (no CPE)range: 15

Patches

Vulnerability mechanics

References

android.googlesource.com/platform/frameworks/base/+/65bd134b0a82c51a143b89821d5cdd00ddc31792nvdMailing ListPatch
rtx.meta.security/exploitation/2024/03/04/Android-run-as-forgery.htmlnvdExploitThird Party Advisory
github.com/metaredteam/external-disclosures/security/advisories/GHSA-m7fh-f3w4-r6v2nvdThird Party Advisory
source.android.com/security/bulletin/2024-03-01nvdNot Applicable
android.googlesource.com/platform/frameworks/base/+/836750619a8bce0bf78fe0549f9990e294671563nvd
android.googlesource.com/platform/frameworks/base/+/954b2874b85b6cd0d6bb12cd677cdf22e5dbd77bnvd
source.android.com/security/bulletin/2024-10-01nvd

News mentions

No linked articles in our index yet.

cvss	0.436
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000