Android Drag-and-Drop Interception Vulnerability in DisplayPolicy Allowing Privilege Escalation

A vulnerability has been identified in the Android operating system within the 'validateAddingWindowLw' function of 'DisplayPolicy.java'. This issue arises from a missing permission check, which creates a potential for applications to intercept drag-and-drop events. Exploitation of this vulnerability could lead to a local escalation of privileges, with no additional execution rights required. Notably, user interaction is not necessary for this exploitation to occur.

Impact

Exploitation of this vulnerability could result in unauthorized privilege escalation, allowing an application to gain elevated rights or access beyond its intended permissions.