The StageCoordinator component in Android contains an oversight in its animation handling that allows a malicious overlay to intercept user interactions. An attacker can place a transparent layer over system controls and without the user noticing trigger privileged actions. This grants local privilege escalation, enabling the attacker to operate with higher privileges than the application without needing to execute arbitrary code.

Google’s Android operating system is affected. No specific Android version information is provided, but any installation that includes the vulnerable StageCoordinator implementation may be at risk.

The vulnerability can be triggered locally without user interaction, allowing an attacker to overlay a transparent UI layer and elevate privileges. The EPSS score of less than 1% indicates that the probability of exploitation in the wild is very low. Nonetheless, the CVSS score of 7.8 reflects the severity of the local privilege escalation. The issue is not listed in CISA’s KEV catalog, and while no publicly disclosed exploit exists, the attack vector remains straightforward for anyone with local device access.