{"id":"ASB-A-349318333", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2026-58836", "A-349318333"], "details":"In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"96552639340851458938414067618559339265", "length":3824}, "id":"ASB-A-349318333-40b7f871", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1", "target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java", "function":"handlePackagePostInstall"}}, {"deprecated":false, "digest":{"line_hashes":["225655952136627345140544747043371473420", "181643256137594243119830058869882159526", "201339850563738457002402554786183575808", "339557525162858247196771881320633270088", "28928597375337600204222332327275969644", "107115069225965149447871763730278748069", "219982860852155744088814255327918757439", "106559757152006970295611668040062029025", "128304521799675867583940051458682298493", "250557203788059399280682980473833803638", "266987544006947530092500999493404866486", "102332067067627989104450103423287840146", "101986957911186362569484053996623160600", "244125084856819352952595829882912148068", "106693184872776943290393094224511021665"], "threshold":0.9}, "id":"ASB-A-349318333-ed232568", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/c06b539f3109383224362ce9ab567a4c78c383e1", "target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"63388427733452695298063355201745534812", "length":4015}, "id":"ASB-A-349318333-b8903094", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60", "target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java", "function":"handlePackagePostInstall"}}, {"deprecated":false, "digest":{"line_hashes":["225655952136627345140544747043371473420", "181643256137594243119830058869882159526", "201339850563738457002402554786183575808", "339557525162858247196771881320633270088", "28928597375337600204222332327275969644", "107115069225965149447871763730278748069", "219982860852155744088814255327918757439", "106559757152006970295611668040062029025", "128304521799675867583940051458682298493", "250557203788059399280682980473833803638", "266987544006947530092500999493404866486", "102332067067627989104450103423287840146", "101986957911186362569484053996623160600", "244125084856819352952595829882912148068", "106693184872776943290393094224511021665"], "threshold":0.9}, "id":"ASB-A-349318333-e428107b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/30083b50c1f18bf617459e5415da03a29366ea60", "target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"185064879593035324171915782227754279035", "length":3782}, "id":"ASB-A-349318333-15531f20", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790", "target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java", "function":"handlePackagePostInstall"}}, {"deprecated":false, "digest":{"line_hashes":["225655952136627345140544747043371473420", "181643256137594243119830058869882159526", "201339850563738457002402554786183575808", "339557525162858247196771881320633270088", "28928597375337600204222332327275969644", "107115069225965149447871763730278748069", "219982860852155744088814255327918757439", "106559757152006970295611668040062029025", "128304521799675867583940051458682298493", "250557203788059399280682980473833803638", "266987544006947530092500999493404866486", "102332067067627989104450103423287840146", "101986957911186362569484053996623160600", "244125084856819352952595829882912148068", "106693184872776943290393094224511021665"], "threshold":0.9}, "id":"ASB-A-349318333-d4b8d4ef", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/a3a6a181f9a634c937e52ef39c181277a1e0f790", "target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a"], "severity":"High", "spl":"2026-11-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["225655952136627345140544747043371473420", "181643256137594243119830058869882159526", "201339850563738457002402554786183575808", "339557525162858247196771881320633270088", "28928597375337600204222332327275969644", "107115069225965149447871763730278748069", "219982860852155744088814255327918757439", "106559757152006970295611668040062029025", "128304521799675867583940051458682298493", "250557203788059399280682980473833803638", "266987544006947530092500999493404866486", "102332067067627989104450103423287840146", "101986957911186362569484053996623160600", "244125084856819352952595829882912148068", "106693184872776943290393094224511021665"], "threshold":0.9}, "id":"ASB-A-349318333-9f38084b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a", "target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java"}}, {"deprecated":false, "digest":{"function_hash":"96552639340851458938414067618559339265", "length":3824}, "id":"ASB-A-349318333-cc53fcde", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/00822bb857ac91e09b10169a9babc075e94a1d3a", "target":{"file":"services/core/java/com/android/server/pm/InstallPackageHelper.java", "function":"handlePackagePostInstall"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}