EUVD-2026-73987
GHSA-grgg-p8r5-q87c
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local delivery via installed app (AV:L, PR:L), mandatory victim tap interaction (UI:R), no scope change, but full device admin impact (C:H/I:H/A:H).
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
6DescriptionCVE.org
In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
AnalysisAI
Tapjacking vulnerability in Android's DeviceAdminAdd.java enables a locally-installed malicious application to render a transparent overlay over the device administrator enrollment screen, coercing users into unknowingly granting device admin privileges. Affected versions span Android 14, 15, 16, and 16-QPR2, covering a broad swath of current Android devices. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A malicious application must be installed on the target Android device, requiring either user-initiated sideload, a compromised app store, or physical device access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) accurately reflects local attack surface constrained by mandatory user interaction and the need for a pre-installed malicious app, keeping real-world exploitation effort non-trivial. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Android Security Patch Level (SPL) from September 2026 as distributed via OEM firmware updates or Google's monthly patch rollout; the fix is documented in the 2026-09-01 Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-09-01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Android 14, 15, 16, and 16-QPR2 devices in your fleet and educate device owners on unfamiliar device administrator enrollment prompts, instructing them to deny any unexpected requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today