CVE-2026-28577: Android WindowManagerService Tapjacking Vulnerability – Local Privilege Escalation

Technical summary

CVE-2026-28577 exists in the addWindow method of WindowManagerService.java, a core Android system service responsible for managing application windows and UI layers. The vulnerability stems from insufficient validation of window overlay permissions or improper enforcement of window stacking rules, enabling an attacker to create transparent or hidden windows that sit above legitimate application windows. Because the Android permissions model trusts installed applications, an app with basic window-creation permissions can exploit this flaw to intercept touch events or spoof UI elements without triggering user warnings. The attack vector is local and requires low privilege (a standard app can trigger it), with no additional execution context needed.

Business impact

Organizations deploying Android devices in security-sensitive roles face elevated risk of credential theft, fraudulent transactions, and unauthorized data exfiltration. An attacker can silently capture login credentials, intercept sensitive gestures (such as payment confirmations), or perform actions on behalf of the user—all while the legitimate application remains visible on screen. This is particularly damaging for enterprises using Android for mobile banking, healthcare records, or sensitive communication. The lack of a user-interaction requirement means attacks can occur automatically upon device compromise, making detection and prevention harder. Downstream impacts include loss of user trust, potential compliance violations (HIPAA, PCI-DSS, GDPR depending on data handled), and incident response costs.

Affected systems

Google Android devices across multiple versions are affected. The vulnerability applies to the core Android operating system where the WindowManagerService component runs; this affects all Android phones, tablets, and other devices running vulnerable Android releases. Given that the source data lists six Android entries (likely representing multiple affected versions or build branches), organizations should treat this as a broad, ecosystem-wide issue rather than a narrow version-specific problem. Verify the exact Android version ranges with Google's official security bulletins or Android Security & Privacy Year in Review documentation.

Exploitability

This vulnerability is highly exploitable. An attacker needs only local access (achieved by tricking a user into installing a malicious app, or through an already-compromised device) and standard application permissions. The attack requires no user interaction—it runs silently in the background—and yields direct privilege escalation within the Android permission model. No CVSS exploit complexity penalty applies (AC:L), indicating straightforward technical execution. The tapjacking technique is well-understood in security research, and once patched versions are identified, bypass or adaptation attempts will likely emerge. The fact that the vulnerability was not added to CISA's Known Exploited Vulnerabilities (KEV) catalog at publication does not diminish its risk; it may reflect limited public disclosure of in-the-wild exploitation at the time of your assessment.

Remediation

Patch Android to the version released by Google that addresses CVE-2026-28577. Contact your device manufacturer (Samsung, OnePlus, etc.) or carrier for rollout timelines, as OEM validation may delay deployment. Android enterprise customers should validate patches in a staging environment before broad rollout. Until patches are deployed, mitigate risk by restricting app installation permissions (disable sideloading of unknown apps), using Mobile Device Management (MDM) to enforce app allowlists, and educating users to install apps only from official Google Play with security reviews enabled. Apps with unusual permission requests should be reviewed; however, this vulnerability may not trigger prominent permission warnings due to its reliance on standard windowing permissions.

Patch guidance

Google will issue a fix through monthly Android Security & Maintenance Releases (ASMR). Verify patch availability by checking Google's official Android Security & Privacy bulletin for June 2026 or later. Device manufacturers and carriers will backport patches to supported device models and Android versions (typically two to three years of support, depending on OEM commitment). To implement: (1) Enroll devices in automatic system update checks where possible; (2) Test patches on a limited device cohort in your organization before full rollout; (3) Prioritize critical devices (those handling banking, healthcare, or sensitive operations) for early patching; (4) Log all patch deployment events for compliance auditing. Work with your MDM provider to automate update enforcement and reporting.

Detection guidance

Detection is challenging because the attack occurs within the window management layer and may not generate obvious user-visible artifacts. Consider: (1) Monitoring device logs for unusual WindowManagerService exceptions or permission denials (requires vendor cooperation or enterprise MDM solutions); (2) Behavioral analysis: look for apps that obtain window permissions but lack visual UI (e.g., background services requesting SYSTEM_ALERT_WINDOW or similar permissions); (3) User education: encourage reporting of unexpected UI behavior (unusual overlay messages, unresponsive buttons); (4) Network-based detection: monitor for anomalous authentication failures, transaction reversals, or credential submissions from android user-agent strings in unusual patterns. Note that advanced attackers may spoof logs, so detection is not foolproof without vendor-provided hardened logging.

Why prioritize this

Assign this HIGH-priority remediation based on the CVSS 7.8 score and the combination of three factors: (1) Local privilege escalation capability—attackers gaining app-level access can escalate to higher privileges; (2) No user interaction required—the attack is autonomous and persistent; (3) High confidentiality, integrity, and availability impact (C:H, I:H, A:H per CVSS vector), meaning successful exploitation compromises all three security goals. For organizations with mobile-first operations or BYOD policies, this approaches CRITICAL severity in terms of business risk, even though the base CVSS is HIGH. Prioritize patching within your security SLA for high-risk vulnerabilities (target: 30–60 days for critical infrastructure or financial services; 90 days for general enterprise).

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector = Local (AV:L, restricting to device-local attackers), Attack Complexity = Low (AC:L, the technique is straightforward), Privileges Required = Low (PR:L, a standard user with an installed app can trigger it), User Interaction = None (UI:N, exploitation is automatic), Scope = Unchanged (S:U, impact is within the Android security boundary), and full compromise of Confidentiality, Integrity, and Availability (C:H, I:H, A:H). The score appropriately reflects the balance: local scope limits maximum severity, but the absence of complexity and user interaction, combined with complete system compromise, elevates it to HIGH. Business context may warrant treating this as critical for organization-specific risk models if mobile devices handle sensitive operations.

Frequently asked questions