CVE-2026-58836 — Vulnerability intelligence
—
Published:
- CVSS
- 7.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.