The flaw resides in the addWindow method of Android’s WindowManagerService, allowing a tapjacking or overlay attack that presents a hidden system UI element without user consent. Leveraging CWE‑1021 (Input Validation), the attacker can perform actions with higher privileges than the normal application context, resulting in local privilege escalation that can compromise device integrity and confidentiality without user interaction.

Android devices that include the unpatched WindowManagerService implementation referenced by Google’s 2026‑06‑01 security bulletin are affected. Version ranges are not disclosed, so all Android firmware builds containing the vulnerable code may be impacted.

Based on the description, the attack vector is inferred to be local on the device, requiring a process that can access WindowManagerService but no user interaction. The CVSS score of 7.8 signifies high severity, while the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation in the wild cannot be quantified from the provided data.