This vulnerability exists in the maybeRemoveInvalidInstallerPackageName function within InstallRepository.kt in Google Android. The flaw allows a permissions bypass that could lead to an unauthorized app update, resulting in local escalation of privilege. Exploitation does not require user interaction or additional execution privileges. The affected versions are Android 16-qpr2 and 17. No CVSS score or vendor remediation information is currently available.

Successful exploitation could allow a local attacker to escalate privileges by bypassing permission checks to perform unauthorized app updates. This could compromise the integrity of the device by enabling elevated code execution under the context of a higher-privileged app or system component. No user interaction is required, increasing the risk of silent exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available from the vendor. Users and administrators should monitor official Google Android security advisories for updates and apply patches once released.