Executive brief
A vulnerability in the Android operating system could allow a malicious application to trick users into granting sensitive permissions. By using a 'tapjacking' technique, an attacker can overlay a deceptive interface over a legitimate system prompt, leading a user to unintentionally authorize access to private data or system functions. This could result in unauthorized access to personal information or elevated control over the device.
Technical details
A vulnerability exists in the InputInterceptor of Letterbox.java within the Android Framework. The flaw enables a tapjacking or overlay attack where a malicious application can render a transparent or misleading UI layer over a legitimate system permission dialog. This allows an attacker to intercept or misdirect user touch events, leading to an unintended grant of permissions. Exploitation results in local escalation of privilege (EoP). While the advisory states user interaction is not needed for 'exploitation' of the bug itself, the nature of tapjacking typically involves a user unknowingly interacting with a hidden UI element. The issue is addressed in the June 2026 Android Security Bulletin for versions 14, 15, and 16.
Affected products
- Google Android 14, 15, 16
Timeline
- 2026-06-01: disclosed: Vulnerability published in Android Security Bulletin and NVD.
- 2026-06-01: patched: Security patch levels of 2026-06-05 or later address this issue.