The answer above was for pre-API-24.
If your app targets API 24 or more (and it should), you need to use something else (otherwise you get FileUriExposedException, as described here) :
File apkFile = new File(...);
Intent intent = new Intent(Intent.ACTION_VIEW);
Uri fileUri = android.support.v4.content.FileProvider.getUriForFile(this, getApplicationContext().getPackageName() + ".provider", apkFile);
intent.setDataAndType(fileUri, "application/vnd.android.package-archive");
intent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
startActivity(intent);
provider_paths.xml:
<?xml version="1.0" encoding="utf-8"?>
<paths xmlns:android="http://schemas.android.com/apk/res/android">
<!--<external-path name="external_files" path="."/>-->
<external-path path="Android/data/YOUR_PACKAGE_NAME" name="files_root" />
<external-path path="." name="external_storage_root" />
</paths>
where YOUR_PACKAGE_NAME is your app's package name.
manifest:
<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
<provider
android:name="android.support.v4.content.FileProvider"
android:authorities="${applicationId}.provider"
android:exported="false"
android:grantUriPermissions="true">
<meta-data
android:name="android.support.FILE_PROVIDER_PATHS"
android:resource="@xml/provider_paths"/>
</provider>