This vulnerability in Android's InstallRepository.kt component involves a logic flaw in the performPreInstallChecks function that can be exploited locally to bypass MDM policies, resulting in elevation of privilege. The flaw allows an attacker with limited privileges to escalate their rights without needing further execution privileges or user interaction. Affected Android versions include 15, 16, and 16-qpr2. The CVSS 3.1 base score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor as of the published date.

Successful exploitation could allow a local attacker to bypass MDM policy enforcement and gain elevated privileges on the affected Android devices. This could compromise device security controls and potentially lead to unauthorized access or modification of sensitive data and system settings. The vulnerability impacts confidentiality, integrity, and availability at a high level according to the CVSS score. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor vendor communications for updates. No specific temporary mitigations or workarounds are provided in the available data.