Executive brief
ContactsPickerActivity is a component in Android that handles displaying contact selection dialogs to users. An attacker can overlay a fake UI on top of this legitimate screen to trick users into performing unintended actions, potentially disclosing sensitive contact information. This attack requires only local access and no user interaction, making it a direct threat to user data privacy.
Technical details
This is a tapjacking/overlay attack vulnerability in the onCreate method of ContactsPickerActivity.kt. The vulnerable component fails to properly prevent UI overlays from obscuring the legitimate contacts picker interface, allowing a local attacker to display misleading UI elements. The attack vector is local and does not require additional execution privileges or user interaction, as a malicious application with local access can overlay windows. An attacker can exploit this to conduct information disclosure by tricking the user through UI confusion without the user realizing they are interacting with a fake interface. Patches are available in Android security patch level 2026-09-05 and later, with fixes applied to Android versions 14 through 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched