Tapjacking Vulnerability in Android's WindowState Component

CVE-2026-59006

What is CVE-2026-59006?

A vulnerability in the getTouchOcclusionMode function of WindowState.java could allow attackers to exploit tapjacking techniques. This issue may enable local information disclosure by overlaying a malicious UI element over legitimate applications, thereby tricking users into unknowingly providing sensitive information. The attack necessitates user interaction to be executed, emphasizing the need for awareness and caution while engaging with applications on affected Android devices.

References