Google Android CVE-2026-0046

The attack requires a locally-installed malicious application on the victim device - the AV:L (local) CVSS vector confirms this as the foundational prerequisite. The attacking app requires no elevated Android permissions (PR:N), meaning a standard user-installed app is sufficient. The flaw is specific to Android's Letterbox windowing context, meaning exploitation is conditioned on the vulnerable letterboxed display path being exercised during a system permission prompt. The stated UI:N metric conflicts with the tapjacking mechanism in the description, which implies user touch interaction is the trigger; security teams should treat this as requiring ambient user device interaction (not zero interaction). Exploitation is limited to Android 14, 15, and 16; earlier versions are not listed as affected. Non-default configuration is not explicitly required - any device running a vulnerable Android version with a sideloaded or malicious Play Store application present is potentially at risk during normal use.

The CVSS 3.1 base score of 6.2 is driven by high confidentiality impact (C:H) combined with a local attack vector (AV:L), low complexity (AC:L), and no required privileges (PR:N). However, the CVSS vector also asserts UI:N (no user interaction), which directly conflicts with the tapjacking description - tapjacking is mechanically dependent on a user tapping a screen element, even if inadvertently. This inconsistency should be verified against the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-06-01; the score may be reflecting that the attacker app requires no deliberate victim cooperation beyond normal device use, but the distinction matters for defenses. EPSS of 0.01% at the 1st percentile indicates very low exploitation probability, consistent with the local-only attack vector that limits reach to devices where a malicious app is already present. No CISA KEV listing and no public proof-of-concept exist at time of analysis. The practical risk is moderate: exploitation requires the victim to have installed a malicious application, Android's permission model is the targeted trust boundary, and the integrity and availability scores are both zero - suggesting data exposure rather than device takeover as the primary concern.

A victim installs a malicious application distributed outside official channels (or via a compromised developer account). The malicious app, requiring no special Android permissions of its own (PR:N), positions a transparent overlay over Android's system permission dialog using the Letterbox InputInterceptor flaw. When the victim's natural device interaction causes a tap, the tap is intercepted and registered as granting a sensitive permission - such as access to contacts, location, or microphone - to the malicious app, escalating its privileges without the user's informed consent. No public proof-of-concept code has been identified at time of analysis.