CVE-2026-0036: Android StageCoordinator Tapjacking Privilege Escalation (CVSS 7.8 HIGH)

Technical summary

The vulnerability exists in the startAnimation method of StageCoordinator.java, where insufficient input validation and touch event handling enable overlay/tapjacking attacks. An unprivileged process (PR:L) can exploit this to escalate privileges and access restricted resources. The attack requires no user awareness (UI:N) and operates entirely within the local attack surface (AV:L). The flaw allows manipulation of animation state transitions that are not properly protected against concurrent touch injection or window overlay techniques, resulting in high impact to confidentiality, integrity, and availability (C:H/I:H/A:H).

Business impact

This vulnerability enables privilege escalation on Android devices without alerting users, creating significant risk for enterprises managing Android fleets. A compromised app could exfiltrate sensitive corporate data, modify system settings, install malware, or lock users out of their devices. For organizations relying on Android for mobile workforce management, remote work, or BYOD programs, exploitation could compromise authentication systems, email access, and document repositories. The lack of user interaction requirement makes this particularly dangerous in managed device scenarios where users may not notice malicious behavior.

Affected systems

The vulnerability affects Google Android across multiple versions. The specific Android versions and security patch levels subject to this flaw should be verified against the official Google security bulletin. Organizations running unpatched Android devices on any affected version are at risk, particularly those with devices that have not received the latest monthly or quarterly security updates from their manufacturer or carrier.

Exploitability

The attack has moderate-to-high practical exploitability. An attacker needs to install a malicious app on the target device (achievable through social engineering, phishing, or if the device has sideloading enabled), but no additional tricks are required once installed—no user interaction, no special permissions to request, and no race conditions to win. However, the attacker must already have local execution context (PR:L), limiting the immediate attack surface to users who have already installed untrusted software. The lack of CISA KEV status suggests this vulnerability is not yet widely weaponized in the wild, though that is not a guarantee of safety.

Remediation

Apply the latest Android security patches released after June 17, 2026 (the modification date). Android patches are typically distributed through monthly security updates. Users should enable automatic system updates; enterprises should mandate patching through mobile device management (MDM) policies. Interim mitigation: restrict app installation to trusted sources only, disable sideloading/unknown sources, and monitor for suspicious app behavior using endpoint detection and response (EDR) or MDM telemetry.

Patch guidance

Verify the specific patch version numbers and affected Android versions in the official Google Android Security & Privacy Year in Review or monthly security bulletin for June 2026 and later. Install updates through Settings > System > System Update or via your device manufacturer's update portal. For enterprise deployments, push patches through your MDM solution and verify compliance reporting confirms all at-risk devices have been remediated. If devices cannot be patched immediately, isolate them from sensitive corporate networks or restrict their use.

Detection guidance

Monitor for unexpected window overlay permissions being requested by apps (via manifest analysis or runtime permission logs). Look for repeated or unusual touch event injection attempts in system logs. Endpoint security solutions should flag apps attempting to manipulate system animation states or access animation-related system services abnormally. In MDM environments, audit app inventory for unsigned or sideloaded applications, and monitor for privilege escalation anomalies in device audit logs. Behavioral indicators include app crashes following failed exploitation attempts and unusual CPU/memory spikes during animation state transitions.

Why prioritize this

This vulnerability is HIGH severity due to its direct local escalation path (CVSS 7.8), absence of friction barriers (no user interaction, no special permissions), and impact to all confidentiality, integrity, and availability attributes. While not yet in CISA's KEV catalog, its technical accessibility and presence in a core Android system component (StageCoordinator) make it a credible near-term exploitation target. Organizations should prioritize patching alongside other HIGH/CRITICAL Android CVEs in their remediation workflows, particularly for devices used by privileged users or for sensitive operations.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L) limiting initial access requirements; low complexity with no special conditions needed (AC:L); low privilege requirements (PR:L) once an app is installed; no user interaction (UI:N); unchanged scope (S:U); and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately penalizes the attack's practical feasibility—an attacker must first get their app onto the device, but once there, escalation is automatic and complete. The HIGH rating is justified given the potential for widespread exploitation across all Android users if reliable exploit code emerges.

Frequently asked questions