A flaw in the Android PackageInstallerService allows a user to remove a Device Policy Controller application from a managed device without explicit Device Owner consent. This desynchronization in persistence handling could let a malicious app, once installed by a user, cause a privileged application to be uninstalled or disabled, effectively elevating the app’s access on the device. The impact is local exploitation that provides broader control over the device’s managed functions, while remaining limited to the device where the user installs the malicious app. The weakness corresponds to improper authorization and omission of required approval steps.

The affected product is Google Android. Any Android devices that run the legacy PackageInstallerService implementation prior to the fix are vulnerable. No specific version numbers are listed in the CNA data, but the issue appears in older managed device environments prior to the Android 17 update. Users on these devices should verify their OS version and apply any available security patches.

The CVSS score of 10 indicates a critical level of severity. The EPSS score of less than 1% signals that the likelihood of exploitation is low; however, the ability to remove a high‑privilege app could have severe consequences for any managed device. The vulnerability is not currently listed in CISA’s KEV catalog, which partially reflects the low real‑world exploitation probability. Attackers must have local device access and the victim must install a malicious application. The attack vector is therefore user‑initiated, requiring the victim to intentionally run an untrusted app. Given the high impact, users should treat this as a priority for patching.