CVE-2026-0046: Android Tapjacking Permission Escalation Vulnerability

Technical summary

The vulnerability resides in Android's InputInterceptor implementation within Letterbox.java, which manages UI input handling and window overlay management. The flaw allows an attacker to craft a tapjacking or UI overlay attack where a transparent or visually deceptive layer intercepts touch events meant for legitimate permission dialogs. By positioning malicious UI elements precisely over the system permission prompt, the attacker can cause the user's tap to activate an approval action while the user believes they are dismissing or denying the request. This is classified under CWE-269 (Improper Access Control), reflecting the unauthorized privilege escalation that results when permissions are granted through deception rather than legitimate user consent. The attack vector is local, requires no special access control (PR:N), and operates under normal conditions (AC:L), meaning any app with basic capabilities can execute this attack.

Business impact

For Android device users and enterprises managing Android fleets, this vulnerability creates a silent privilege escalation pathway. Users unknowingly grant sensitive permissions—such as access to contacts, location, microphone, or camera—to attacker-controlled applications. In a business context, this could expose corporate data on employee mobile devices, compromise confidentiality of user information, and facilitate secondary attacks once elevated permissions are obtained. The vulnerability does not provide code execution directly but dramatically lowers the barrier to gaining dangerous capabilities. Organizations relying on Android for work should expect increased risk of data exfiltration and unauthorized monitoring if devices run unpatched versions.

Affected systems

Google Android across multiple versions is affected by this vulnerability. The specific version boundaries and device models have not been detailed in available advisories at this time; organizations should consult Google's official Android Security & Privacy Year in Review bulletins and device-specific security updates to determine which devices and OS versions require patching. Given the core nature of the Letterbox component, this likely impacts a broad range of Android devices.

Exploitability

Exploitability is moderate to high in practical terms. The attack requires local access to the device and a malicious application, but the CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that no special privileges are required beforehand and the attack conditions are straightforward to satisfy. The UI:N designation indicates that user awareness is not a factor—exploitation succeeds without the user recognizing the deception. An attacker can distribute the malicious app through third-party app stores or social engineering. However, this vulnerability has not been flagged as an in-the-wild exploitation target (KEV status: not active), suggesting that while the technical barrier is low, widespread real-world abuse has not yet been observed at publication.

Remediation

The primary remediation is to apply Google's official security patch when released. Users should enable automatic system updates and check Settings > About Phone for the latest Android Security Patch Level. Organizations should deploy Mobile Device Management (MDM) policies to enforce minimum Android patch levels and restrict installation of apps from untrusted sources. As a complementary control, users should audit granted app permissions regularly and revoke unnecessary access through Settings > Apps > Permissions. Until patches are available, consider restricting high-risk applications from installation on sensitive devices.

Patch guidance

Monitor Google's official Android Security & Privacy bulletins and device manufacturer security updates for the patch addressing CVE-2026-0046. Apply patches as soon as they become available through your device's system update mechanism or via your organization's MDM solution. For enterprise deployments, validate patch availability on your specific device models and Android versions before mandating updates, as some devices may receive patches later than others. Verify patch installation by confirming the updated Android Security Patch Level matches or exceeds the release date of the patch.

Detection guidance

Detection of exploitation attempts is challenging because the attack is behavioral and local. Monitor for unusual app behavior post-installation, particularly if users report granting permissions they do not recall approving. On enterprise Android devices managed via MDM, enable permission monitoring and alert on unexpected permission grants to sensitive capabilities (camera, microphone, location, contacts). Behavioral analytics looking for rapid permission escalation after app installation may surface suspicious patterns. At the system level, examine InputInterceptor logs and overlay detection mechanisms if available through your device management console.

Why prioritize this

Prioritize this vulnerability for patching in the medium range. The CVSS score of 6.2 reflects moderate risk, but the complete absence of user interaction requirements and the silent nature of the attack elevate practical concern. The confidentiality impact is marked as high (C:H), meaning sensitive user data becomes accessible once permissions are granted. Organizations with significant Android device populations, particularly those handling sensitive corporate or personal data, should treat this as a priority patch cycle. The lack of active exploitation (non-KEV status) provides a window to plan and deploy patches methodically.

Risk score, explained

CVE-2026-0046 scores 6.2 (MEDIUM) under CVSS 3.1 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The score reflects: local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), all of which make the attack easy to execute. The high confidentiality impact (C:H) is offset by the lack of integrity or availability impact (I:N/A:N)—the attacker gains access to sensitive data but cannot modify system behavior or deny service. The scope is unchanged (S:U), meaning the impact is limited to the Android system itself.

Frequently asked questions