CVE-2026-0068

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the createSessionInternal() function within PackageInstallerService.java that allows the removal of a Device Policy Controller (DPC) app from a managed device without the consent of the Device Owner (DO). This issue is caused by a desynchronization from persistence. An attacker could achieve local escalation of privilege by installing a malicious application, although user interaction is required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.