Dynamically loading code from unknown sources is not recommended. This can lead to remote code injection. Also note that dynamically loading code from a known location but over an unsafe connection can result in attacks (i.e., the downloaded code can be tampered with). Similarly, dynamic installation of APK files should be prevented.

Prevent writing code which can dynamically execute code from other sources. Dynamically loading APK files is also discouraged. This functionality will usually fail since this is a settings option that is disabled by default for security reasons.

Either remove the offending code or use a third-party library such as Grab-n-Run which offers secure dynamic loading of code. A secure code example which uses Grab-n-Run is given below.

String jarContainerPath = "some.apk";
try {
  Map<String, URL> packageNamesToCertMap = new HashMap<String, URL>();
  packageNamesToCertMap.put("com.example", new URL("certificate.pem"));
  SecureLoaderFactory mSecureLoaderFactory = new SecureLoaderFactory(this);
  SecureDexClassLoader mSecureDexClassLoader = mSecureLoaderFactory.createDexClassLoader(
    jarContainerPath,null,getClass().getClassLoader(), packageNamesToCertMap);
  Class<?> loadedClass = mSecureDexClassLoader.loadClass("com.example.MyClass");
} catch (...) {
  ...
}

• (GitHub) Grab'n Run: Secure and Practical Dynamic Code Loading for Android Applications
• Tech.Co - Dynamically Loading Code Securely with Android