Executive brief
Android's Intent forwarding mechanism can be tricked into granting permissions without user knowledge through a tapjacking overlay attack. An attacker can place a malicious overlay on top of the system's permission prompt, causing users to unknowingly grant access to sensitive device functions or data. This can lead to unauthorized access to user information and device capabilities.
Technical details
A tapjacking/overlay attack vulnerability exists in the buildMiniResolver method of IntentForwarderActivity.java in the Android Framework. The vulnerability allows an attacker to bypass user consent by overlaying malicious content on top of the system's intent resolution UI, tricking the user into granting permissions they did not intend to grant. The attack requires no additional execution privileges and no user interaction beyond the normal tap gesture. An attacker can exploit this to escalate privileges locally and gain unauthorized access to protected system functions or data. Patches are available in AOSP branches 14, 15, 16, 16-qpr2, and 17 with a security patch level of 2026-09-05 or later.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue