CVE-2026-58836
HIGH
NVD
CVSS Score
7.8
Severity
HIGH
Published
Nov 02, 2026
Vendor
unknown
Description
In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.