The vulnerability CVE-2026-0088 exists in the getCallingAppLabel method of CertInstaller.java in Google Android. It allows an attacker to hide a sensitive security dialogue by exploiting misleading or insufficient user interface elements. This flaw can be leveraged for local privilege escalation without needing user interaction or additional execution privileges. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected Android versions include 14, 15, 16, and 16-qpr2. No official patch or remediation level has been published yet, and there are no known exploits in the wild.

Successful exploitation of this vulnerability could allow a local attacker to escalate privileges on the affected Android device, potentially gaining higher access rights than intended. This could compromise the confidentiality, integrity, and availability of the device and its data. No user interaction is required, increasing the risk of silent exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, users and administrators should monitor Google's security advisories for updates. Until a patch is available, restricting local access to trusted users and minimizing exposure to untrusted applications may reduce risk.