Android MediaProvider and Documents UI Tapjacking Vulnerability Allowing Local Privilege Escalation

A tapjacking vulnerability has been identified in the Android MediaProvider and Documents UI components. This issue arises from a logic error in the code, which creates a potential for local privilege escalation. Notably, the vulnerability can be exploited without requiring additional execution privileges or user interaction. Affected devices can be updated to the June 2026 security patch level to address this vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized elevation of privileges, allowing a user to gain access to restricted functions or data.

Remediation

Users can update their devices to the June 2026 security patch level to address this vulnerability. For some devices on Android 10 and later, the Google Play system update will include this patch. Instructions for checking and updating the Android version are available on the Google Play support page.