The ClusterRenderingService.dump() method, when invoked by processes that hold android.permission.DUMP and android.permission.PACKAGE_USAGE_STATS, misuses its elevated privileges to write arbitrary values to Settings.Global.OVERLAY_DISPLAY_DEVICES. This setting normally requires the android.permission.WRITE_SECURE_SETTINGS permission, which is not granted to ordinary applications. By controlling this setting, an attacker can create persistent system overlay displays and inject key events into the cluster UI, potentially allowing the execution of malicious input or the display of deceptive interfaces. The vulnerability effectively turns the service into a confused deputy that elevates attacker capabilities beyond the intended permission model.

Affected systems include Google Android devices. No specific version information is provided in the available data. Users running Android operating systems that include the ClusterRenderingService component should consider checking for patch releases from Google.

The CVSS score is not available in the data, and the EPSS score is not provided. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an app that obtains the DUMP and PACKAGE_USAGE_STATS permissions—either through user consent, device owner privileges, or during setup—can exploit the flaw. Exploitation would allow the attacker to bypass the secure settings permission, enabling persistent overlay creation and key event injection, which could lead to phishing, session hijacking, or other malicious actions within the cluster UI.