Technical impact
The vulnerability is a logic flaw in Android’s performPreInstallChecks function of InstallRepository.kt that allows an attacker to bypass Mobile Device Management (MDM) policy checks. By exploiting this flaw, a local user can elevate privileges without requiring any additional execution rights or user interaction, potentially gaining full control over the device. This weakness represents an elevation of privilege flaw that compromises device security and integrity.
Affected Systems
Affected systems include all Android devices running versions that include the flawed performPreInstallChecks logic. The vulnerability is tied to Google’s Android platform, and the specific affected releases are not enumerated in the available data.
Risk and Exploitability
Risk and exploitability remain high because local privilege escalation can be achieved readily on affected devices. The CVSS score of 7.8 indicates moderate to high severity, and the EPSS score of <1% suggests a low but non‑zero exploitation probability. The absence of user interaction combined with the local nature of the attack implies a realistic threat. The flaw is not listed in CISA’s KEV catalog, yet its severity warrants immediate attention once a patch is available.
