CVE-2019-2218

HIGH

Android 8.0-10 - Missing Authorization in PackageInstallerService

Title source: llm

Description

In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check. This could lead to local escalation of privilege by installing malicious packages with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-141169173

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://source.android.com/security/bulletin/2020-01-01

Scores

CVSS v3 7.8

EPSS 0.0015

EPSS Percentile 4.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-862

Status published

Products (1)

google/android 10.0

Published Dec 06, 2019

Tracked Since Feb 18, 2026