CVE-2009-1754: Google Android

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted attackers to access application data by creating a package that specifies a shared user ID with an arbitrary application.

Affected products

• Google Android: version 1.5 only

Published 2009-05-26. Last modified 2026-06-16.