CVE-2026-0061: Android WindowState Tapjacking Vulnerability – Permission Escalation Risk

Technical summary

The vulnerability exists in multiple functions within WindowState.java where insufficient validation of UI overlay layers permits a malicious application to render content atop the system permission request interface. An attacker can position a transparent or visually deceptive overlay that captures or redirects user touches intended for the permission dialog, effectively tricking the system into granting permissions. This is classified as a CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) issue. The CVSS score of 5.9 reflects local attack vector, low complexity, no privilege requirement, and impacts on confidentiality, integrity, and availability within a single user context.

Business impact

A successful exploitation allows unprivileged applications to escalate their capabilities by obtaining permissions they should not have—such as camera, microphone, location, or contacts access—without proper user consent. This threatens user privacy (unauthorized surveillance or data exfiltration), data integrity (unauthorized modifications), and operational security. Enterprise deployments face risk of employee devices being compromised to exfiltrate sensitive corporate data or enable targeted surveillance. The attack is particularly dangerous because it bypasses Android's permission model, which is a foundational security boundary.

Affected systems

The vulnerability affects multiple versions of Google Android across the identified product entries. Organizations relying on Android devices should consult Google's security bulletin and patch release notes to determine exact version ranges affected. Typically such WindowState issues span multiple API levels and device configurations. Verification of your specific Android versions against the official advisory is essential.

Exploitability

While not yet listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, the attack is technically straightforward: an attacker distributes a malicious app that runs in the background, monitors for permission dialogs, and overlays a deceptive UI. The CVSS vector indicates no user interaction is required in the sense that the attack executes automatically once the app is installed and a permission prompt appears. However, the initial app installation still requires user action (a pre-condition outside the vulnerability scope itself). The local-only attack vector limits exposure to devices where the malicious application can be installed.

Remediation

Primary remediation is applying Google's security patches for Android as they become available. Users and administrators should prioritize patching across their Android device fleet. Concurrent mitigations include restricting installation of untrusted apps via Google Play Protect, disabling installation from unknown sources, and using Mobile Device Management (MDM) to enforce strict app policies. Code-level, this requires hardening WindowState UI validation to detect and reject overlay attempts on system permission dialogs.

Patch guidance

Monitor Google's monthly Android security bulletin for patches addressing CVE-2026-0061. Patches are typically released via Google Play System Update or device manufacturer OTA updates depending on the Android version and device model. Organizations should test patches in a controlled environment before broad deployment. Prioritize devices that handle sensitive corporate data or are used in high-security contexts. Verify patch version numbers against Google's official security advisory before deployment.

Detection guidance

Detection is challenging at runtime because the attack occurs within the UI layer. Behavioral indicators include: unusual permission grants after a brief permission dialog display, app install logs followed by unexpected permission grants, and anomalous background process activity concurrent with permission prompts. MDM solutions can monitor for suspicious app installations and permission patterns. Forensic analysis of compromised devices should focus on app installation timestamps and permission grant logs to correlate malicious app presence with privilege escalation events.

Why prioritize this

Although rated MEDIUM severity, the practical risk is elevated due to the attack's invisibility to end users and its bypass of Android's core permission model. Organizations with users handling sensitive data, intellectual property, or regulated information (healthcare, finance, legal) should prioritize patching. The lack of KEV listing suggests active exploitation may not yet be widespread, providing a window for proactive patching before adversaries adopt this technique at scale.

Risk score, explained

The CVSS 5.9 MEDIUM score reflects the local-only attack vector (AV:L), which limits exposure to installed apps; low attack complexity (AC:L); no privilege requirement (PR:N); and impacts across confidentiality, integrity, and availability (C:L/I:L/A:L). However, the real-world risk is higher because the vulnerability completely bypasses a security model users rely on, and the exploitation is automated once an app is installed. Organizations should treat this as higher priority than the numeric score alone suggests.

Frequently asked questions