CVE-2024-31324: Google Android Privilege Escalation Flaw

CVE-2024-31324 Overview

CVE-2024-31324 is a tapjacking/overlay protection bypass in the Android WindowState.java component of the platform framework. Attackers can bypass overlay protections by launching an activity in portrait mode and then rotating it to landscape mode. Successful exploitation leads to local privilege escalation with user execution privileges. The issue affects Android 12, 12L, 13, and 14, and requires user interaction. Google addressed the flaw in the June 2024 Android Security Bulletin. This weakness is classified as improper restriction of rendered UI layers or frames [CWE-1021].

Critical Impact
Local privilege escalation via tapjacking bypass, enabling malicious apps to trick users into granting sensitive permissions or actions through overlaid UI.

Affected Products

Google Android 12.0
Google Android 12.1 (12L)
Google Android 13.0
Google Android 14.0

Discovery Timeline

2024-06-01 - Fix published in the Android Security Bulletin for June 2024
2024-07-09 - CVE-2024-31324 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31324

Vulnerability Analysis

The vulnerability resides in the hide method of WindowState.java, part of the Android window manager in the platform framework. Android enforces tapjacking and overlay protections to prevent malicious apps from intercepting or spoofing touch events on sensitive UI surfaces. The hide logic fails to consistently apply these protections across orientation changes. An application that launches an activity in portrait mode and then rotates the device to landscape can bypass the overlay protection checks. The classification under [CWE-1021] reflects an improper restriction of rendered UI layers, which enables UI redress attacks against the user.

Root Cause

The root cause is inconsistent state handling in the WindowState.hide path when window orientation changes. Overlay-protection flags evaluated at initial layout are not re-evaluated after rotation. This allows an overlay window to remain interactive on top of protected content in the new orientation.

Attack Vector

Exploitation is local and requires a malicious app installed on the device along with user interaction. The attacker's app creates an activity in portrait mode, triggers a rotation to landscape, and places overlay UI over privileged prompts such as permission grants or system dialogs. The user, believing they are interacting with legitimate UI, taps controls whose events are routed to the attacker's benefit. The result is elevation of privilege at the user execution boundary.

No verified exploitation code is publicly available. See the Android Security Bulletin June 2024 for the official technical description.

Detection Methods for CVE-2024-31324

Indicators of Compromise

Applications that request the SYSTEM_ALERT_WINDOW permission and create overlay windows immediately before or after activity rotation events.
Unexpected configChanges handling for orientation combined with TYPE_APPLICATION_OVERLAY windows in third-party apps.
User reports of permission dialogs or system prompts appearing beneath overlay content.

Detection Strategies

Inspect installed APKs for manifest declarations combining overlay permissions with activities that force rotation transitions.
Review mobile threat defense telemetry for apps that programmatically call setRequestedOrientation shortly after displaying overlay views.
Correlate WindowManageraddView events with orientation change broadcasts in device logs where available.

Monitoring Recommendations

Track Android security patch level (SPL) across the fleet and alert on devices below the 2024-06-01 patch level.
Monitor enterprise app catalogs and sideloaded package installations on managed Android devices.
Ingest mobile device management (MDM) inventory into your SIEM to surface out-of-date Android builds.

How to Mitigate CVE-2024-31324

Immediate Actions Required

Apply the June 2024 Android security patch (SPL 2024-06-01) or later on all Android 12, 12L, 13, and 14 devices.
Enforce minimum patch level policies through MDM/UEM and block noncompliant devices from corporate resources.
Audit installed applications on managed devices for those requesting SYSTEM_ALERT_WINDOW and remove untrusted apps.

Patch Information

Google released the fix in the Android Security Bulletin June 2024. The upstream code change is available in the AOSP commit for frameworks/base: Android Source Code Update. Device manufacturers ship the fix as part of vendor-specific security patch levels aligned to 2024-06-01 or newer.

Workarounds

Disable the display-over-other-apps permission for untrusted applications under Settings → Apps → Special app access.
Restrict app installation to Google Play and enforce Play Protect scanning on managed devices.
Educate users to avoid granting permissions or approving prompts when unexpected overlays appear on screen.

bash

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2024-06-01 or later