CVE-2026-0023Disclosure(google / android)

LOWCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for google android systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

google CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

https://source.android.com/docs/security/bulletin/2026/2026-03-01

Weakness type (CWE)

CWE-269

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

android

Threat summary

Public PoC and exploit tooling are both present
4 mentions across 3 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-03-03); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

google

Products

android

3 versions affected across 1 product

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

PoC

125.0%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-03	2	Disclosure2
2026-03-21	1	General1
2026-06-11	1	PoC1

Full discourse4 posts

dbugs@ptdbugs119d
PoC
Andriod LPE CVE: CVE-2026-0023 PT ID: PT-2026-4703 Vendor: Google Product: Android CVSS: 7.8 Credits: n/a Description: In createSessionInternal of http://PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-0023 • https://source.android.com/docs/security/bulletin/2026/2026-03-01 PoC/Exploit: https://github.com/QM4RS/CVE-2026-0023-Update-Ownership-PoC #dbugs_vuln
Post summary
The post announces CVE-2026-0023, a local privilege escalation in Android's PackageInstallerService, and publishes a PoC, but does not report active exploitation or a patch.
04024182.4K
2.7K followersView on X
CVETrends@CVEShield201d
General
Top 5 Trending CVEs: 1 - CVE-2025-24132 2 - CVE-2026-20963 3 - CVE-2023-50428 4 - CVE-2026-0023 5 - CVE-2024-21320 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The post simply lists trending CVE identifiers without any detailed information or actionable content.
00020332
1.7K followersView on X
The Hacker Wire@TheHackerWire219d
Disclosure
🟠 CVE-2026-0023 - High In createSessionInternal of http://PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of p... https://www.thehackerwire.com/vulnerability/CVE-2026-0023/ https://t.co/nMPMFrVyQF
Post summary
The post announces CVE-2026-0023, a local privilege escalation vulnerability in Android's PackageInstallerService due to a missing permission check, providing technical details but no PoC, exploit, or patch information.
0000038
121 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds219d
Disclosure
CVE-2026-0023 Local Privilege Escalation in Android PackageInstallerService via Ownership Update https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-0023
Post summary
A new local privilege escalation vulnerability (CVE-2026-0023) affecting Android's PackageInstallerService via an ownership update has been disclosed, but no PoC, exploit, patch, or active exploitation details are provided.
0000060
4.0K followersView on X

CPE platform detail6 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

6 of 6 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	google	android	14.0	-	-
OS	google	android	15.0	-	-
OS	google	android	16.0	-	-
OS	google	android	16.0	-	-
OS	google	android	16.0	-	-
OS	google	android	16.0	-	-

Explore more

Back to dashboard google CVEs android vulnerabilities

What researchers are saying

CVE-2026-0023

dbugs[verified]@ptdbugsPoC

The post announces CVE-2026-0023, a local privilege escalation in Android's PackageInstallerService, and publishes a PoC, but does not report active exploitation or a patch.

CVETrends@CVEShieldGeneral

The post simply lists trending CVE identifiers without any detailed information or actionable content.

The Hacker Wire@TheHackerWireDisclosure

The post announces CVE-2026-0023, a local privilege escalation vulnerability in Android's PackageInstallerService due to a missing permission check, providing technical details but no PoC, exploit, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new local privilege escalation vulnerability (CVE-2026-0023) affecting Android's PackageInstallerService via an ownership update has been disclosed, but no PoC, exploit, patch, or active exploitation details are provided.