In the Android WindowState.java component, a tapjacking or overlay attack can be performed, allowing a malicious surface to capture user taps. This flaw enables local disclosure of information without granting the attacker any additional execution privileges. An attacker would need user interaction to execute the attack, but no elevated permissions are required.

Android devices running the affected Google Android version(s). No specific version numbers are listed in the available data; the vulnerability is noted in the 2026‑11‑01 security bulletin.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit at this time. Given the lack of a CVSS rating, the severity is unknown, but the requirement for user interaction and the local nature of the disclosure suggest a moderate risk. Exploitation would likely involve tricking a user into tapping where the overlay should not be present.