Executive brief
A security vulnerability in the Android WindowManagerService could allow a malicious application to perform a tapjacking or overlay attack. This allows an attacker to trick users into performing unintended actions or grant elevated permissions by placing an invisible or misleading layer over the screen. If exploited, this could lead to a full takeover of the device's functions without the user's knowledge.
Technical details
A tapjacking/overlay vulnerability exists in the 'addWindow' method of WindowManagerService.java within the Android Framework. The flaw allows a local malicious application to bypass security UI protections by overlaying malicious content or intercepting touch events, leading to an escalation of privilege (EoP). Unlike many overlay attacks, the advisory states that user interaction is not required for exploitation, suggesting a bypass of standard overlay security constraints. The issue affects Android versions 14, 15, 16, and 16-qpr2. A fix is available via the June 2026 Android Security Bulletin.
Affected products
- Google Android Framework 14, 15, 16, 16-qpr2
Timeline
- 2026-06-01: disclosed: Vulnerability published in the June 2026 Android Security Bulletin.
- 2026-06-01: patched: Security patch levels of 2026-06-05 or later address this issue.