Skip to content
OpenAdvisories
Critical · 10.0 CVE-2026-28575 EUVD-2026-37566GHSA-689p-ppgm-x7pf

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a p…

Published Jun 17, 2026 · Updated Jun 17, 2026 · Assigned by google_android

Description

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

VendorProductAffectedFixed
Google Android 17 —

Advisories 1

References