EUVD-2026-33769
GHSA-3rqv-c78p-x6c8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryAcquire overlay drawing capability
-
ExploitTrigger privileged system animation
-
ExecutionRender overlay during startAnimation window
-
PersistCapture or redirect privileged action
-
ImpactEscalate to higher privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Clickjacking prevention, X-Frame-Options
|
| Exploitation Conditions | Attacker must already have code execution on the device as a local app with at least low privileges (CVSS PR:L) - typically a sideloaded or store-delivered malicious application; the device must be running Android 14, 15, 16, or 16-qpr2 prior to the 2026-06-01 security patch level; and the attacker app must be able to draw windows over other apps (commonly via the SYSTEM_ALERT_WINDOW permission or an abuse path that does not require it) so that the overlay can be presented during the vulnerable StageCoordinator.startAnimation transition. Exploitation is limited by the requirement for local presence (no remote/network reachability per AV:L), the need for the malicious app to be installed and running, and the timing constraint of coinciding the overlay with the targeted animation; user interaction beyond normal device use is not required (UI:N). |
| Impact | The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a locally exploitable, low-complexity flaw requiring some prior privileges but no user interaction, scoring 7.8 (High). The EPSS score of 0.01% (1st percentile) and the absence of CISA KEV listing indicate this is not currently being mass-exploited. The description's claim of 'User interaction is not needed' is somewhat at odds with the nature of tapjacking (which traditionally requires the user to tap a deceptive overlay) - this likely means no additional consent dialogs need to be bypassed by the user, but defenders should verify with Google's bulletin. Overall this is a meaningful but not urgent priority: it requires a pre-installed or sideloaded malicious app on the device, so it is a privilege-escalation building block for malware rather than a remote drive-by issue. The 'XSS' tag in the input appears mislabeled - tapjacking is a UI redress weakness (CWE-1021), not a cross-site scripting issue, and should be disregarded. |
| Exploit ScenarioDerived | A malicious app installed on the device (e.g., sideloaded or delivered via a tainted store listing) holds minimal privileges and draws an overlay window timed to coincide with a system animation handled by StageCoordinator.startAnimation. During the animation transition the overlay covers a privileged dialog or surface, causing actions to be attributed to the privileged context and granting the malicious app elevated capabilities. No public proof-of-concept code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) is possible via a tapjacking/overlay attack against the startAnimation function in StageCoordinator.java. An attacker with local code execution can elevate privileges without user interaction or additional execution rights. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.01%).
RemediationAI
Apply the Android Security Bulletin 2026-06-01 patch level or later as published at https://source.android.com/docs/security/bulletin/2026/2026-06-01 - the bulletin should be consulted for the exact security patch level (SPL) string required for Android 14, 15, 16, and 16-qpr2. A specific fix version was not included in the supplied intelligence, so treat this as patch available per vendor advisory and confirm the SPL string directly from Google's bulletin before deployment. While awaiting OEM rollout, compensating controls include disabling the 'Display over other apps' / SYSTEM_ALERT_WINDOW permission for all non-essential apps in Settings, enabling Google Play Protect to detect overlay-abusing apps, and avoiding sideloaded APKs from untrusted sources; the trade-off is that some legitimate accessibility, chat-head, and screen-recording apps will lose overlay functionality. Enterprise fleets should push a managed configuration through MDM that restricts the overlay permission and blocks unknown sources.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in StageCoordinator.java, a component of Android's system UI/window management responsible for orchestrating window stage transitions and animations. The root cause maps to CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), the classic 'tapjacking' weakness where a malicious overlay window can intercept or mask UI interactions belonging to a more privileged window. Because startAnimation does not adequately verify that the visible UI layer is the legitimate target of input/animation events, an attacker-controlled overlay can be drawn over privileged dialogs or system surfaces during the animation window. The CPE confirms the issue affects Google's Android platform itself rather than a specific OEM skin, meaning the defect is in AOSP/system-level code shipped across Android 14, 15, 16, and 16-qpr2 devices.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android versions 14-16 contain a privilege escalation vulnerability affecting billions of devices globally. While the likelihood of current exploitation is low, the vulnerability could enable attackers who have compromised a device through malware to gain complete administrative control-a risk that organizations with Android device fleets must address through interim controls until Google releases a patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce SELinux in enforcing mode; (2) Restrict app installation to official app stores only via MDM policies; (3) Implement mandatory code signing verification; (4) Monitor Android security logs for privilege escalation attempts; (5) Disable USB debugging and disable developer mode; (6) Enforce strong device passcodes and biometric authentication; (7) Segment critical-function devices on isolated network subnets; (8) Monitor Google Android Security & Privacy releases weekly for patch availability and develop rapid deployment procedures when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB