A logic error in Android’s tap handling code creates a potential tapjacking flaw that can enable local privilege escalation without the need for additional execution privileges. Because user interaction is not required, the flaw can be exploited by triggering the logic error through a malicious user interface component, allowing an attacker to perform privileged actions as if they were a trusted application.

The vulnerability is found in Google’s Android operating system. No specific vendor or version details are given, so any Android device running an unpatched build that contains the identified logic error may be affected. All devices with the affected code paths remain potentially vulnerable until a fix is applied.

The Exploit Prediction Scoring System score is not available and the vulnerability is not listed in CISA KEV. The flaw provides local privilege escalation, which would grant an attacker the same level of permission as the affected privileged component. Based on the description, it is inferred that an attacker could trigger the logic error by installing or interacting with an application capable of presenting an overlay or malicious UI component; this would bypass the need for user interaction. Given the high impact of LPE and the lack of guardrails, the security risk is significant in environments where additional privileges are granted to apps that can display overlays or otherwise influence touch input.