Google Android EUVD-2026-33778

Local access is required - the CVSS AV:L vector confirms the attacker must have a malicious application installed and running on the target device; remote exploitation is not possible without a prior installation vector such as social engineering or a separate app installation vulnerability. CVSS PR:N confirms the attacker's application requires no prior elevated privileges on the device. The specific vulnerable codepath is the hide() method within WindowState.java in the Android window management layer. Exploitation timing is constrained: the overlay must be active and correctly positioned at the precise moment a permission dialog is displayed to the user. The attack is bounded to Android versions 14, 15, 16, and 16-QPR2; devices running June 2026 SPL or later are not affected. The CVSS UI:N designation reflects Android's classification convention - the user's incidental tap during normal device operation is sufficient; the attacker does not need to separately direct victim interaction beyond having the malicious app running.

The CVSS 3.1 score of 6.8 (Medium) is driven by AV:L (local attack vector - attacker must have code running on the device), AC:L (low complexity once in position), PR:N (no prior elevated privileges required for the attacker's app), UI:N (per Android scoring convention, normal device interaction is not counted as attacker-required interaction), and S:U (unchanged scope). Confidentiality impact is High (unauthorized permission grants may expose sensitive data such as location, contacts, or microphone), while Integrity impact is Low and Availability is None. A notable tension exists between the description - which describes tricking a user into approving permissions, inherently contingent on a user tapping during the overlay window's active period - and the CVSS UI:N classification; Android's scoring methodology designates UI:N here because the victim takes no action specifically instigated by the attacker. Defenders should interpret this as 'the attack can complete during routine device use without unusual victim behavior,' not as 'fully automated with zero user involvement.' The EPSS score of 0.01% (1st percentile) and absence from CISA KEV both indicate very low observed exploitation interest, making this a standard-cadence patch priority rather than an emergency response item. Real-world exploitation is further constrained by the requirement for local app installation.

An attacker publishes a seemingly benign application and convinces the target to install it on their Android device via sideloading or a third-party store. Once active, the app exploits the WindowState.java hide() flaw to position a transparent overlay precisely over a system permission request dialog - for example, a request for location or microphone access - at the moment it appears. The user, seeing only the system dialog, taps 'Allow,' but the tap is captured by the overlay and attributed to the malicious app's own permission request, silently granting it elevated access. No public exploit code has been identified at time of analysis, though the tapjacking technique is well-documented in Android security literature and the conceptual approach is broadly understood.