The AccessibilityWindowManager implementation in Android lacks a permission check for setAccessibilityWindowAttributes, allowing a local, non‑privileged application to modify the attributes of a UI window. This flaw is a classic case of improper access control and enables an attacker to elevate privileges by manipulating the UI state of a privileged component without executing code with higher privileges or requiring user interaction. The attacker can use this to circumvent UI barriers or hide malicious content from the user.

Android devices running versions of the operating system that include the vulnerable AccessibilityWindowManager code, as identified by the vendor’s November 2026 security bulletin. The issue impacts all Android installations that have not applied the latest patch from Google.

No CVSS score is publicly listed and the EPSS value is unavailable, but the problem is not yet reported in the CISA KEV catalog, indicating no known public exploits. Nevertheless, the vulnerability can be triggered locally by any installed app that does not require user interaction, making the likelihood of exploitation moderate to high until a patch is applied. Attacks would involve an adversary installing or running a malicious application that calls the privileged interface to alter UI attributes.