This vulnerability exists in the createSessionInternal function of PackageInstallerService.java in Google Android 17. Due to a desynchronization issue with persistence, it is possible to remove a DPC app from a managed device without the Device Owner's consent. A local attacker who can trick a user into installing a malicious app can leverage this flaw to escalate privileges on the device. No additional execution privileges are required beyond the ability to install the app, but user interaction is necessary for exploitation. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction needed for the attack vector itself, but user interaction is needed for exploitation. The vulnerability is classified under CWE-362 (Race Condition). No patch or remediation level has been provided by the vendor yet.

Successful exploitation allows local privilege escalation by removing a DPC app from a managed device without consent, potentially compromising device management controls. This could undermine security policies enforced by the Device Owner, leading to unauthorized control or configuration changes on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should exercise caution with app installations and avoid installing apps from untrusted sources. Monitor vendor communications for updates on patches or mitigations.