Executive brief
Wear OS contains a tapjacking vulnerability in the device administration component that allows attackers to overlay malicious UI elements over legitimate system screens. By tricking users into tapping on hidden controls, an attacker can escalate privileges without requiring special permissions. This could lead to unauthorized access to sensitive device functions and user data.
Technical details
A tapjacking/overlay attack vulnerability exists in multiple functions of DeviceAdminAdd.java in the Wear OS System component. The vulnerability allows an attacker to create transparent or deceptive overlay windows that intercept user interactions intended for legitimate system UI elements. No additional execution privileges are required, but user interaction (a tap) is needed to trigger the exploit. Successful exploitation leads to local privilege escalation. The vulnerability affects Wear OS versions 14 and 16, with patches available in the 2026-09-01 security patch level or later.
Affected products
- Google Wear OS 14, 16
Timeline
- 2026-09-08: disclosed: CVE-2026-28656 published in Wear OS Security Bulletin
- 2026-09-01: patched: Security patch level 2026-09-01 or later addresses this issue