EUVD-2026-33766
GHSA-4cr7-7jgp-q22r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser installs malicious app
-
DeliveryApp requests overlay/standard permissions
-
ExploitApp draws obscuring overlay over privileged UI
-
ExecutionLogic error accepts obscured tap
-
PersistPrivileged action executes silently
-
ImpactAttacker app gains elevated capability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have local code execution on the device as a low-privileged installed app (CVSS PR:L, AV:L) - typically a sideloaded or Play-Store-delivered malicious APK running on Android 15 or Android 16. No user interaction is required on the targeted privileged prompt (UI:N), which is the defining characteristic of this tapjacking issue, but the user must first install and launch the attacker-controlled app. Exploitation is limited to devices that have not received the 2026-06-01 Android security patch level, and is constrained by Android sandboxing such that the elevated privileges gained correspond to whatever capability the obscured UI flow normally guards rather than instant root. |
| Impact | Signals are mixed and require careful weighting. CVSS 7.8 (High) reflects full CIA impact (C:H/I:H/A:H) achievable from a local, low-privileged context with no user interaction, and SSVC flags this as Automatable=yes with Technical Impact=partial, meaning a malicious app can reliably script the bypass. However, EPSS is only 0.01% (1st percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis - so the realistic exposure is constrained to scenarios where a victim sideloads or installs a hostile app. There is a minor tension worth flagging: SSVC reports Technical Impact as 'partial' while CVSS rates all three impact metrics as High, suggesting the practical privilege gain may be narrower than the raw CVSS score implies. Overall this is a meaningful patch-this-cycle issue for managed Android fleets, not an emergency. |
| Exploit ScenarioDerived | A user installs a seemingly benign app (game, utility, wallpaper) from a third-party store or via social engineering; the app draws an overlay or invokes a vulnerable framework UI flow that obscures a privileged confirmation prompt. Because the logic error allows the obscured tap to proceed without user awareness or interaction on the intended dialog, the attacker silently elevates to capabilities normally gated by a user grant, achieving local privilege escalation. No public exploit identified at time of analysis, but SSVC marks the technique as automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 03, 2026
Local privilege escalation in Google Android 15 and 16 enables a low-privileged app to perform tapjacking due to a logic error spanning multiple code locations, with no user interaction required. The flaw, tracked as CVE-2026-0009 and disclosed in the June 2026 Android Security Bulletin, has no public exploit identified at time of analysis, but SSVC scoring deems exploitation automatable with partial technical impact. EPSS is very low (0.01%, 1st percentile), suggesting limited near-term mass exploitation pressure.
Earlier versions of this analysis (2)
Local privilege escalation in Google Android 15 and 16 enables a low-privileged app to perform tapjacking due to a logic error across multiple code locations, allowing escalation to higher privileges without any user interaction. The flaw is tracked as CWE-269 (Improper Privilege Management) and carries a CVSS 7.8; no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.01%.
Local privilege escalation in Google Android 15 and 16 exploits a tapjacking logic error present across multiple framework locations, allowing an unprivileged local attacker to access sensitive data without requiring elevated permissions or triggering any user interaction. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates low-complexity local exploitation with high confidentiality impact, though the UI:N designation is atypical for tapjacking and warrants verification against the vendor bulletin. No public exploit has been identified at time of analysis, and an EPSS score of 0.01% reflects minimal observed exploitation in the wild.
RemediationAI
Apply the June 2026 Android security patch level (2026-06-01 or later) as published in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-06-01; exact downstream build numbers depend on the OEM and device model, so consult the device vendor's update channel. Where patching is delayed, compensating controls include enabling Google Play Protect to block known malicious overlays, disabling the 'Display over other apps' / SYSTEM_ALERT_WINDOW permission on untrusted apps via Settings → Apps → Special access, restricting sideloading through MDM policy (block 'Install unknown apps'), and enforcing a managed-app catalog for enterprise fleets - note the trade-off that disabling overlay permission breaks legitimate accessibility, chat-head, and screen-recording apps. No vendor-confirmed standalone workaround is documented for the underlying logic error, so patching is the durable fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying weakness is CWE-269 (Improper Privilege Management) realized as a tapjacking primitive - a UI-overlay class of attack where a malicious application overlays or obscures security-relevant prompts (such as permission dialogs or confirmation screens) so the user unknowingly grants elevated capabilities to the attacker app. Because the defect is described as a logic error in 'multiple locations' within the Android framework (cpe:2.3:a:google:android), it likely involves missing or inconsistent overlay/obscured-touch checks (e.g., FLAG_WINDOW_IS_OBSCURED / setFilterTouchesWhenObscured semantics) in privileged UI flows. The CVSS vector AV:L/AC:L/PR:L/UI:N confirms the attack originates from an installed app with low privileges and does not need an explicit user tap on the intended target, which is consistent with a tapjacking bypass that converts an apparently benign touch into a privileged action.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
7DescriptionCVE.org
In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
CVE-2026-0009 is a local privilege escalation in Google Android 15 and 16 allowing apps to gain elevated system privileges without user interaction; no public exploit identified at time of analysis. Organizations with Android mobile deployments face potential device compromise that could facilitate data theft or unauthorized access to corporate systems, particularly in BYOD environments.
No vendor-released patch identified at time of analysis. Mitigations include: app allowlisting enforcement via MDM, disabling sideloading and USB debugging on managed devices, mandatory app review processes before installation, regular security patching cycles, privilege escalation detection in device logs, and network isolation of BYOD devices from sensitive corporate segments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB