Executive brief
A logic error in Android's WindowState component allows an app to bypass overlay restrictions, potentially enabling privilege escalation. An attacker with a malicious app on a device can exploit this flaw locally without requiring additional system permissions or user interaction, potentially gaining unauthorized access to system functions or sensitive data.
Technical details
This vulnerability is a logic error in the setHiddenWhileSuspended method of WindowState.java that enables an overlay bypass. The flaw allows for local escalation of privilege (EoP) with no additional execution privileges required and no user interaction needed for exploitation. The vulnerability affects Android's window management and overlay security controls, which are critical for preventing malicious apps from drawing unauthorized UI elements over system windows or other apps. Patches are available in Android versions 14, 15, 16, 16-qpr2, and 17 according to the September 2026 security bulletin.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue