Executive brief
A security vulnerability exists in the Android operating system's Picture-in-Picture (PiP) task management component. This flaw allows a malicious application to bypass background activity restrictions, potentially launching unauthorized screens or gaining elevated privileges on the device. An attacker could exploit this without any interaction from the user, compromising the security and privacy of the device.
Technical details
A confused deputy vulnerability exists within multiple functions of PipTaskOrganizer.java in the Android Framework. The flaw allows a local malicious application to trigger activity launches from the background, bypassing standard Android security restrictions intended to prevent background apps from interrupting the user or gaining focus. This is classified as an Elevation of Privilege (EoP) vulnerability because it allows an app to perform actions (launching activities) that should be restricted based on its current state. Exploitation requires no additional execution privileges and no user interaction. The issue is addressed in the June 2026 Android Security Bulletin for Android version 14.
Affected products
- Google Android Framework 14
Timeline
- 2026-06-01: advisory: Published in the June 2026 Android Security Bulletin
- 2026-06-01: disclosed: CVE published to NVD dataset