CVE-2026-0092: Google Android Package Manager Missing Authorization Check
CVE-2026-0092 is a critical issue in the Package Manager component of Google Android, described as a possible bypass of the device lock controller caused by a missing permission check. The record describes local escalation of privilege without user interaction, and it lists Android 17.0 and 17 as affected. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version, so administrators should check the vendor bulletin for the patched build.
Overview
The CVE record for CVE-2026-0092 describes a possible device lock controller bypass in the Package Manager component of Google Android. The weakness is attributed to a missing permission check, classified as CWE-862 Missing Authorization. The CNA is google_android, and the record cites the Android 17 security bulletin as a vendor advisory.
Impact
According to the description, the issue could allow local escalation of privilege without additional execution privileges and without user interaction. The record reports a CVSS score of 10 with severity critical. Its vector string marks confidentiality, integrity and availability impact as high, and SSVC lists technical impact as total and automatable as no. The vector's attack vector field is set to network, which does not match the local framing in the description, so the real exposure should be confirmed with the vendor.
Affected products and versions
The record lists Google Android with versions 17.0 and 17. No other versions are listed in the sources consulted. The record contains no fixed version, so the absence of a fix in the record should not be read as the absence of a fix from the vendor.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. SSVC exploitation is recorded as none. The EPSS probability is 0.00218 with a percentile of 0.1162, as recorded. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Review the Android 17 security bulletin and apply the update that includes the fix for this CVE on all affected devices.
- Prioritize devices with sensitive data, managed fleets and devices where users install applications from untrusted sources.
- Enforce current device management policies and keep devices on supported security patch levels until the update is confirmed.
Detection guidance
- Inventory Android devices and record their security patch levels to identify those not yet updated.
- Monitor for unexpected changes in device lock state, unexplained privilege changes or unusual application management activity, and review device logs where available.
Limitations of the available information
The record does not include the content of the vendor bulletin, so the patched build and any vendor-specific details are unknown. The description and the CVSS vector differ on attack vector. The EPSS date in the record (2026-10-23) is later than the publication date, so the EPSS values should be interpreted with care. No technical details of the flaw are provided, and this analysis does not include them.
Frequently asked questions
What is CVE-2026-0092?
It is a critical weakness in the Google Android Package Manager component, described as a possible device lock controller bypass caused by a missing permission check. The record classifies it as CWE-862 Missing Authorization.
Which Android versions are listed as affected?
The record lists Google Android 17.0 and 17. No other versions appear in the sources consulted.
Is this vulnerability being actively exploited?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.
What should administrators do?
Review the Android 17 security bulletin referenced in the record, apply the vendor update on affected devices, and prioritize managed fleets and devices with sensitive data.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.