{"id":"ASB-A-452042097", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-25T15:18:14.132838247Z", "aliases":["CVE-2025-48652", "A-452042097"], "details":"In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/81f83fdb0944d0d8a3337d2578d73dd77d60143b", "https://android.googlesource.com/platform/frameworks/base/+/3a8cafbc916bb16f08093cd138a4f3d4dc71b5a0"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"250422163576007906311266012289777872182", "length":5212}, "id":"ASB-A-452042097-2768598b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/81f83fdb0944d0d8a3337d2578d73dd77d60143b", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"100030477261424655126180009970891241346", "length":5368}, "id":"ASB-A-452042097-33d4d5e6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3a8cafbc916bb16f08093cd138a4f3d4dc71b5a0", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["287132440164127787900311066968192799727", "164519494202683672545617179320789003357", "138171701637261579886780142808251429156", "118950082544996558241270151258894954790", "205962933611596569598905475197057681318", "339212848590255868881735291014739566110", "86108500175382950414919141294367363625", "156764555094095553428736879062392066565", "191532771678698477672970247084537738412", "255581199148193568627533287425454229027", "290675925820840181720862084669207068026", "55677350880354714741032176669907204269", "71184792004730734152824800369152777495", "255767029212197698652256852376734350990", "207698343155878492333116002183090507131", "68481736996391822122261320336070972728", "212135947151508281235870612616797972870", "127273446773051425750538227936562897688", "47370117806126140198103485369132863627"], "threshold":0.9}, "id":"ASB-A-452042097-55c52e00", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/3a8cafbc916bb16f08093cd138a4f3d4dc71b5a0", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9d20d0ae8fef770df8788e287feee1bdaa1d82fe", "https://android.googlesource.com/platform/frameworks/base/+/2037b1942fa03b2bcef1a594391a9066843e12b9"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["337914855583033950000470837460687568703", "323225291477559724252769863747976871550", "12993850030047719886337886213116709527", "69218230836534493503370581312937399404", "211131758483743502972810153806039891018", "55706111860254569511876067929323968701", "15453643987758595554831692251290408253", "287467501295358791479963012926649940917", "205962933611596569598905475197057681318", "339212848590255868881735291014739566110", "86108500175382950414919141294367363625", "156764555094095553428736879062392066565", "191532771678698477672970247084537738412", "255581199148193568627533287425454229027", "290675925820840181720862084669207068026", "55677350880354714741032176669907204269", "71184792004730734152824800369152777495", "255767029212197698652256852376734350990", "207698343155878492333116002183090507131", "68481736996391822122261320336070972728", "212135947151508281235870612616797972870", "127273446773051425750538227936562897688", "47370117806126140198103485369132863627"], "threshold":0.9}, "id":"ASB-A-452042097-14ec3c63", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/2037b1942fa03b2bcef1a594391a9066843e12b9", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"}}, {"deprecated":false, "digest":{"function_hash":"94295996917709442584824378661522274239", "length":4878}, "id":"ASB-A-452042097-6d8dcdeb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/2037b1942fa03b2bcef1a594391a9066843e12b9", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"287453740526710581950574342339092744209", "length":4689}, "id":"ASB-A-452042097-87a15bf4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9d20d0ae8fef770df8788e287feee1bdaa1d82fe", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["328548339366017752016247469880555865525", "71368936658131001356163451329700918830", "238712992803264733650657741741603873037", "137322820868736966531532931221043606766", "243762482219670487913519775635378928871", "199978472912560643564452394414264356089", "190232638976956763741150218767635461710", "156070560232633049248674495065622431630", "21234215190283236317895917982949994798", "339251475197397614607041173548238204571", "140080411196817140487499909367994882185", "41417576202939934957899041741923888323", "93706148092658107260797983135435416517"], "threshold":0.9}, "id":"ASB-A-452042097-b40482c0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9d20d0ae8fef770df8788e287feee1bdaa1d82fe", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6e0b7c02e54a0c8f26ecb2eefd136677df7decfc", "https://android.googlesource.com/platform/frameworks/base/+/9aec06e22b59a74f7bc90d285eee3a52963c6a91"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["337914855583033950000470837460687568703", "323225291477559724252769863747976871550", "12993850030047719886337886213116709527", "69218230836534493503370581312937399404", "211131758483743502972810153806039891018", "55706111860254569511876067929323968701", "15453643987758595554831692251290408253", "287467501295358791479963012926649940917", "205962933611596569598905475197057681318", "339212848590255868881735291014739566110", "86108500175382950414919141294367363625", "156764555094095553428736879062392066565", "191532771678698477672970247084537738412", "255581199148193568627533287425454229027", "290675925820840181720862084669207068026", "55677350880354714741032176669907204269", "71184792004730734152824800369152777495", "255767029212197698652256852376734350990", "207698343155878492333116002183090507131", "68481736996391822122261320336070972728", "212135947151508281235870612616797972870", "127273446773051425750538227936562897688", "47370117806126140198103485369132863627"], "threshold":0.9}, "id":"ASB-A-452042097-2ec0fc1a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9aec06e22b59a74f7bc90d285eee3a52963c6a91", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"}}, {"deprecated":false, "digest":{"function_hash":"97780827404223550033223079363767928414", "length":4781}, "id":"ASB-A-452042097-4b7d3266", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6e0b7c02e54a0c8f26ecb2eefd136677df7decfc", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"line_hashes":["328548339366017752016247469880555865525", "71368936658131001356163451329700918830", "238712992803264733650657741741603873037", "137322820868736966531532931221043606766", "243762482219670487913519775635378928871", "199978472912560643564452394414264356089", "190232638976956763741150218767635461710", "156070560232633049248674495065622431630", "21234215190283236317895917982949994798", "339251475197397614607041173548238204571", "140080411196817140487499909367994882185", "41417576202939934957899041741923888323", "93706148092658107260797983135435416517"], "threshold":0.9}, "id":"ASB-A-452042097-b6fd1b5b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/6e0b7c02e54a0c8f26ecb2eefd136677df7decfc", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"}}, {"deprecated":false, "digest":{"function_hash":"338345737930857674648825227169806103949", "length":4970}, "id":"ASB-A-452042097-eadf6ee6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/9aec06e22b59a74f7bc90d285eee3a52963c6a91", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java", "function":"onCreate"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/982f43f3bbdb55751913fa6752051df639a5e719", "https://android.googlesource.com/platform/frameworks/base/+/59d1cf64718bacec47b2a0c5138473fb0708a007"], "severity":"High", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["287132440164127787900311066968192799727", "164519494202683672545617179320789003357", "138171701637261579886780142808251429156", "118950082544996558241270151258894954790", "205962933611596569598905475197057681318", "339212848590255868881735291014739566110", "86108500175382950414919141294367363625", "156764555094095553428736879062392066565", "191532771678698477672970247084537738412", "255581199148193568627533287425454229027", "290675925820840181720862084669207068026", "55677350880354714741032176669907204269", "71184792004730734152824800369152777495", "255767029212197698652256852376734350990", "207698343155878492333116002183090507131", "68481736996391822122261320336070972728", "212135947151508281235870612616797972870", "127273446773051425750538227936562897688", "47370117806126140198103485369132863627"], "threshold":0.9}, "id":"ASB-A-452042097-19910e38", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/59d1cf64718bacec47b2a0c5138473fb0708a007", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"}}, {"deprecated":false, "digest":{"function_hash":"250422163576007906311266012289777872182", "length":5212}, "id":"ASB-A-452042097-6826f139", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/982f43f3bbdb55751913fa6752051df639a5e719", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java", "function":"onCreate"}}, {"deprecated":false, "digest":{"function_hash":"100030477261424655126180009970891241346", "length":5368}, "id":"ASB-A-452042097-7471a56b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/59d1cf64718bacec47b2a0c5138473fb0708a007", "target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java", "function":"onCreate"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/4dc009cd724cc1cac5202737a36fd99a36817fef"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/a37dfe713785cf6668e37b2db51ddd0117d000fd"}]}