Tapjacking Vulnerability in Android's WindowState.java

CVE-2026-0048

What is CVE-2026-0048?

A vulnerability exists in the WindowState.java file of the Android operating system, enabling a potential tapjacking or overlay attack. This flaw allows an attacker to manipulate the user interface, tricking users into approving unauthorized permissions without their knowledge. The exploitation of this vulnerability does not require any additional execution privileges or user interaction, which poses a significant risk to the security and privacy of affected devices, particularly in scenarios involving sensitive applications.

References