The StageCoordinator component in Android contains an oversight in its animation handling that allows a malicious overlay to intercept user interactions. An attacker can place a transparent layer over system controls and without the user noticing trigger privileged actions. This grants local privilege escalation, enabling the attacker to operate with higher privileges than the application without needing to execute arbitrary code.

Google’s Android operating system is affected. No specific Android version information is provided, but any installation that includes the vulnerable StageCoordinator implementation may be at risk.

The vulnerability can be triggered locally and does not require user interaction, indicating a high likelihood of exploitation when an attacker can place malicious overlays on the device. The CVSS score of 7.8 and the EPSS score of less than 1% reflect a high severity but low exploitation probability. The nature of the flaw—local privilege escalation from a UI overlay—suggests a severe security impact. The issue is not listed in CISA’s KEV catalog, but the absence of a publicly known exploit does not diminish the potential danger as the attack vector is straightforward for an attacker with local device access.