{"id":"CVE-2026-58836","kind":"vulnerability","aliases":["CVE-2026-58836"],"related":[],"title":"Android: sideloaded app can bypass Enhanced Confirmation Mode during self-update","description":"In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","summary":"A logic error in Android's package install code lets a sideloaded app change its package source during a self-update, bypassing Enhanced Confirmation Mode. An attacker gets local privilege escalation with no user interaction, though a local app must already be installed.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Android","fixed":["security patch level 2026-11-05"],"affected":"AOSP 16, 16-qpr2, 17 (security patch level before 2026-11-05)","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","framework","mobile","runtime","sideloaded-apps"],"not_affected_if":["sideloading-blocked"],"how_to_check":"Settings > About phone > Android version > Android security patch level: if it is earlier than 2026-11-05 and the device runs Android 16, 16-QPR2 or 17, it is not patched. Android 14 and 15 are not listed for this CVE.","fix":"Install an Android security patch level of 2026-11-05 or later (November 2026 bulletin; this CVE is in the 2026-11-01 section).","status":"open","published_at":"2026-11-02T20:17:48+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","triaged_at":"2026-11-02T20:39:05+00:00","updated_at":"2026-11-02T20:41:24+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-02T20:39:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android: sideloaded app can bypass Enhanced Confirmation Mode during self-update","impact":"high","summary":"A logic error in Android's package install code lets a sideloaded app change its package source during a self-update, bypassing Enhanced Confirmation Mode. An attacker gets local privilege escalation with no user interaction, though a local app must already be installed.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["android","mobile","sideloaded-apps"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sideloaded app escalates privileges locally on the device","analyst_note":"Find the Android security bulletin entry for CVE-2026-58836 to get affected versions and the patched patch level.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["sideloading-blocked"],"who_is_affected":"The flaw is in the Android framework's package installer, so devices running affected Android builds are exposed when a sideloaded app is present. The sources do not name affected Android versions or patch levels. Managed devices that block sideloading are less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":4151,"output_tokens":463,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Android security bulletin entry for CVE-2026-58836 to get affected versions and the patched patch level.","search":"'-2026':14A,17A '-58836':15A,18A 'allow':86C 'alreadi':68B 'android':1A,19A,20B,31B 'app':3A,26B,39B,66B 'applic':89C 'attack':54B 'bypass':5A,49B,83C 'chang':40B 'code':35B,107C 'confirm':7A,51B,80C 'could':109C 'cve':13A,16A 'due':100C 'ecm':82C 'enhanc':6A,50B,79C 'error':29B,104C 'escal':58B,113C 'execut':118C 'exploit':127C 'framework':21B 'get':55B 'handlepackagepostinstal':72C 'instal':34B,70B 'installpackagehelper.java':74C 'interact':62B,122C 'lead':110C 'let':36B 'local':56B,65B,112C 'logic':28B,103C 'mobil':22B 'mode':8A,52B,81C 'modifi':91C 'must':67B 'need':120C,125C 'packag':33B,42B,93C 'possibl':78C 'privileg':57B,115C,119C 'runtim':23B 'self':11A,47B,98C 'self-upd':10A,46B,97C 'sideload':2A,25B,38B,88C 'sideloaded-app':24B 'sourc':43B,94C 'though':63B 'updat':12A,48B,99C 'user':61B,117C,121C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the Android framework's package installer, so devices running affected Android builds are exposed when a sideloaded app is present. The sources do not name affected Android versions or patch levels. Managed devices that block sideloading are less exposed, but the sources do not confirm this.","tier":"B","verified":{"fix":{"at":"2026-11-02T20:41:24Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1426},"products":{"at":"2026-11-02T20:41:24Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1426},"how_to_check":{"at":"2026-11-02T20:41:24Z","by":"analyst","doc":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","run_id":1426}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Android phone to the November 2026 security update (patch level 2026-11-05 or later): Settings > System > Software update, once your phone maker releases it.","pkeys":["android"],"ptokens":["android"],"labels":["android","framework","high","mobile","runtime","sideloadedapps"],"first_public_at":"2026-11-02T20:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58836","severity":null,"published_at":"2026-11-02T20:17:48+00:00","modified_at":"2026-11-02T20:17:48+00:00","first_seen_at":"2026-11-02T20:35:31+00:00","fetched_at":"2026-11-02T20:35:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-58836:1426","url":null,"severity":null,"published_at":"2026-11-02T20:41:24+00:00","modified_at":"2026-11-02T20:41:24+00:00","first_seen_at":"2026-11-02T20:41:24+00:00","fetched_at":"2026-11-02T20:41:24+00:00","note":"Found in Android Security Bulletin Nov 2026 (Framework, EoP, High, A-349318333, AOSP 16/16-qpr2/17). Bulletin gives no bug description; the sideload/Enhanced Confirmation detail comes from triage/NVD and is unverified. No exploitation or PoC found; OffSeq says not exploited. x-cli not used."}],"documents":[{"id":53783,"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","title":"Android Security Bulletin—November 2026","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}