This vulnerability in Android 17 arises from a flaw in the createSessionInternal method of PackageInstallerService.java. Due to a desynchronization issue with persistence, it is possible to remove a DPC app from a managed device without the Device Owner's consent. An attacker with local access who can trick a user into installing a malicious app could exploit this to escalate privileges on the device. No additional execution privileges are required, but user interaction is necessary for exploitation.

Successful exploitation can lead to local privilege escalation on affected Android 17 devices by removing critical management apps without authorization. This undermines device management controls and could allow malicious apps to gain elevated privileges, potentially compromising device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time.