CVE-2026-0055

Vulnerability

In createSessionInternal of PackageInstallerService.java, a path traversal error allows a Device Policy Controller (DPC) to be updated into an invalid directory. This vulnerability affects Android versions prior to the June 2026 security update.

Exploitation

An attacker with the ability to install or update a Device Policy Controller (DPC) can exploit this vulnerability. No user interaction is required. The attacker crafts a malicious DPC package that, when installed, leverages the path traversal to write files to unintended locations on the system.

Impact

Successful exploitation allows for local privilege escalation. An attacker can gain elevated privileges on the device without needing additional execution privileges, potentially leading to unauthorized access or control over system functions.

Mitigation

This vulnerability was addressed in the June 2026 Android Security Bulletin [1]. Users should ensure their devices are updated to receive these security patches. No specific workarounds are mentioned in the available references, and the end-of-life status for affected versions is not yet disclosed.