A flaw in Android’s WindowState.java allows an attacker to overlay a concealed view that can trick a user into approving permissions. The technique, known as tapjacking or overlay attack, can be executed without the user needing to perform any explicit interaction and can elevate local privileges. The vulnerability is exposed by improper handling of overlay windows and user permissions, enabling an app to gain privileges beyond its intended scope.

The issue affects Google Android devices; specific OS versions impacted are not listed in the advisory and tables, so all releases may be at risk until patched.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of less than 1% shows a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no known public exploitation yet. The attack requires no extra execution privileges and relies on a tapjacking/overlay technique that can be performed without user interaction. Typically, any app that can display overlays poses the attack surface, allowing an attacker to raise local privileges on a device running the affected Android version.