Android InputInterceptor Tapjacking Vulnerability Allowing Local Privilege Escalation

A vulnerability has been identified in the InputInterceptor component of Letterbox.java, where a tapjacking or overlay attack could be used to deceive a user into granting a permission. This issue allows for local escalation of privilege without requiring any additional execution privileges. Notably, exploitation of this vulnerability does not involve user interaction.

Impact

Exploitation of this vulnerability could lead to unauthorized privileges being granted to an application or process, allowing it to perform actions or access resources that would normally be restricted.

Remediation

Users can update their devices to the June 2026 security patch level to address this vulnerability.