Android Framework Tapjacking Vulnerability in WindowState.java Allowing Privilege Escalation

A vulnerability has been identified in the Android Framework component, specifically within multiple functions of WindowState.java. This issue involves a tapjacking or overlay attack that can deceive users into accepting permissions. Exploitation of this vulnerability could lead to local escalation of privileges, with no additional execution rights required. Notably, user interaction is not necessary for the exploitation to occur.

Impact

Exploitation of this vulnerability could result in unauthorized elevation of privileges, allowing a user to gain higher access rights or permissions than intended.

Remediation

Users can update their devices to the June 2026 security patch level to address this vulnerability. Instructions for checking and updating the Android version are available on the Google Support website.