CVE-2026-0092: Critical severity Android Package Manager vulnerability
In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement or restore an explicit permission check in the device lock controller to verify caller privileges before performing device lock operations. Ensure the controller enforces the minimum required privileges for the requested action and apply any vendor-supplied patch when it becomes available.
Package Manager (device lock controller) permission_check = enabled/implemented - Compensating control
Restrict local access to systems running the Package Manager to trusted administrative accounts only (network/host ACLs, jump hosts, or console access controls). Remove or disable unnecessary local accounts and limit who can invoke device lock operations to reduce the risk of local privilege escalation.
- Operational
Monitor and audit Package Manager and system logs for unexpected device lock operations or privilege-elevation attempts. If unauthorized activity is detected or compromise is suspected, investigate immediately and follow incident-response procedures (containment, remediation, and recovery); consider credential rotation for impacted accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0092?
CVE-2026-0092 has a critical severity rating of 10.
What is the risk associated with CVE-2026-0092?
CVE-2026-0092 has a risk value of 87, indicating a high level of vulnerability.
How do I fix CVE-2026-0092?
To fix CVE-2026-0092, ensure you update your Android device to the latest security patch provided by the manufacturer.
Can CVE-2026-0092 be exploited remotely?
No, CVE-2026-0092 requires local access to exploit the vulnerability.
Does CVE-2026-0092 require user interaction for exploitation?
No, CVE-2026-0092 can be exploited without any user interaction.