Executive brief
A vulnerability in the Android operating system's animation handling could allow a malicious application to perform a 'tapjacking' attack. This occurs when an invisible or misleading layer is placed over the screen, tricking the system into granting the attacker elevated permissions or access to sensitive data. This could lead to a full compromise of the device's security settings without the user realizing their actions were being hijacked.
Technical details
A tapjacking/overlay vulnerability exists in the 'startAnimation' method of 'StageCoordinator.java' within the Android Framework. The flaw allows a malicious local application to overlay its own UI elements or intercept touch events intended for system-level security prompts. This can lead to local escalation of privilege (EoP) because the system may process sensitive actions as if they were authorized by the user. Notably, the advisory states that user interaction is not needed for exploitation, suggesting the overlay can programmatically trigger or bypass confirmation logic. The issue is addressed in the June 2026 Android Security Bulletin for versions 14, 15, and 16.
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory
- 2026-06-01: patched