CVE-2020-27059 Overview
CVE-2020-27059 is a tapjacking vulnerability in the Android AuthenticationClient.java component. The flaw resides in the onAuthenticated method, which fails to detect overlaid windows when prompting the user for fingerprint authentication. An attacker controlling a malicious application can overlay an attacker-controlled window during a fingerprint prompt and trick the user into authorizing actions on a hidden underlying activity. Successful exploitation results in local privilege escalation without requiring additional execution privileges. The issue affects Android versions 8.0, 8.1, 9, 10, and 11, tracked internally by Google as Android ID A-159249069 and classified under CWE-1021 (Improper Restriction of Rendered UI Layers).
Critical Impact
A malicious app can hijack fingerprint authentication prompts via UI overlay to gain local privilege escalation across Android 8.0 through 11.
Affected Products
- Google Android 8.0 and 8.1
- Google Android 9 and 10
- Google Android 11
Discovery Timeline
- 2021-01-11 - CVE-2020-27059 published to the National Vulnerability Database (NVD)
- 2021-01-01 - Addressed in the Android Security Bulletin January 2021
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2020-27059
Vulnerability Analysis
The vulnerability is a tapjacking issue (a UI-redress attack) in Android's biometric authentication flow. When the AuthenticationClient requests a user's fingerprint, the system displays an authentication dialog. The onAuthenticated callback path does not enforce protection against windows drawn on top of the prompt. A malicious application with SYSTEM_ALERT_WINDOW capability or an abused accessibility overlay can render content above the fingerprint dialog. The user believes they are interacting with the attacker's benign-looking overlay while the underlying authenticated context grants privileged actions.
Exploitation requires user interaction, specifically the placement of the user's finger on the sensor. However, no additional execution privileges are required by the attacker app beyond standard overlay capabilities. The outcome is local escalation of privilege, allowing the attacker to perform sensitive operations gated by biometric confirmation.
Root Cause
The root cause is the absence of an obscured-touch check (such as FLAG_WINDOW_IS_OBSCURED validation) in the authentication confirmation path inside AuthenticationClient.java. Android's biometric framework should reject or warn on confirmations delivered while another window is overlaid on the authentication surface. This omission falls under CWE-1021, Improper Restriction of Rendered UI Layers or Frames.
Attack Vector
The attack is local and requires the victim to install or run a malicious application. The attacker app registers an overlay window using legitimate Android APIs, then triggers or waits for a fingerprint prompt from a higher-privileged context. The overlay covers the legitimate prompt while passing fingerprint sensor input through to the underlying authentication client. When the user authenticates, the privileged action is confirmed without the user's informed consent.
No verified public proof-of-concept code is available for this issue. Refer to the Android Security Bulletin January 2021 for vendor technical details.
Detection Methods for CVE-2020-27059
Indicators of Compromise
- Installed applications that request the SYSTEM_ALERT_WINDOW permission combined with biometric or accessibility APIs without a clear business need.
- Mobile device management (MDM) logs showing overlay windows active during system biometric prompts.
- User reports of unexpected fingerprint prompts immediately after launching a third-party application.
Detection Strategies
- Inventory installed APKs and flag any that declare both SYSTEM_ALERT_WINDOW and accessibility service usage for manual review.
- Use mobile threat defense (MTD) tooling to identify applications that draw overlays during sensitive system UI events.
- Correlate sideloaded application installations with subsequent privileged actions on enrolled devices.
Monitoring Recommendations
- Monitor Android security patch level (SPL) on managed devices and alert on devices below the 2021-01-01 patch level.
- Track applications requesting overlay permissions and review their behavior in a sandboxed environment.
- Enable logging of biometric authentication events and review for unexpected confirmations tied to background apps.
How to Mitigate CVE-2020-27059
Immediate Actions Required
- Apply the Android Security Patch Level 2021-01-01 or later to all Android 8.0, 8.1, 9, 10, and 11 devices.
- Remove or restrict third-party applications that request SYSTEM_ALERT_WINDOW without a justified use case.
- Enforce MDM policies that prohibit installation of applications from unknown sources.
Patch Information
Google addressed the issue in the Android Security Bulletin January 2021. The fix introduces overlay detection in the AuthenticationClient confirmation path, rejecting authentication results when the prompt window is obscured. Device manufacturers ship the patch as part of the 2021-01-01 security patch level.
Workarounds
- Disable the "Draw over other apps" permission for untrusted applications under Settings > Apps > Special access.
- Restrict accessibility service permissions to vetted enterprise applications only.
- Use a mobile threat defense agent to identify and block applications that abuse overlay APIs on devices still pending the security patch.
# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Expected output: 2021-01-01 or later
# List applications granted SYSTEM_ALERT_WINDOW
adb shell appops get <package_name> SYSTEM_ALERT_WINDOW
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
