The Android InputInterceptor in Letterbox.java contains a flaw that can be exploited through a tapjacking or overlay attack to trick a user into granting a permission that they did not intend to accept. This flaw allows an attacker to locally elevate privileges without requiring additional execution privileges or user interaction. The result is that the attacker can gain higher access rights on the device, potentially compromising data and functionality that should be protected by the operating system.

Google Android devices are affected by this vulnerability. No specific Android OS version or build number is listed in the current data, so all installations that include the vulnerable Letterbox component should be considered at risk unless they have applied the latest security updates.

The absence of an EPSS score and the lack of listing in the CISA KEV catalog do not necessarily indicate low risk; the flaw enables local privilege escalation and can be triggered without user involvement. Attackers could construct an overlay interface that mimics a legitimate permission dialog, bypassing the user’s intent. Given the potential impact on device security and the lack of a public exploit reference, the risk to affected devices is significant, especially in environments where users are prone to interacting with overlay windows.