Live › vulnerability › CVE-2026-58836
A logic error in Android's package install code lets a sideloaded app change its package source during a self-update, bypassing Enhanced Confirmation Mode. An attacker gets local privilege escalation with no user interaction, though a local app must already be installed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
The flaw is in the Android framework's package installer, so devices running affected Android builds are exposed when a sideloaded app is present. The sources do not name affected Android versions or patch levels. Managed devices that block sideloading are less exposed, but the sources do not confirm this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Android | vendor | AOSP 16, 16-qpr2, 17 (security patch level before 2026-11-05) | security patch level 2026-11-05 |
Install an Android security patch level of 2026-11-05 or later (November 2026 bulletin; this CVE is in the 2026-11-01 section).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-58836")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.