CVE-2025-0080 Overview
CVE-2025-0080 is a tapjacking/overlay vulnerability in Google Android that allows a malicious application to overlay the system installation confirmation dialog. An attacker can trick the user into approving actions that lead to local privilege escalation without any additional execution privileges. The flaw affects multiple locations in the Android framework and is tracked under CWE-250: Execution with Unnecessary Privileges.
Critical Impact
A locally installed malicious app can hijack installation prompts through screen overlays, escalating privileges on Android 15 devices without user awareness.
Affected Products
- Google Android 15.0
- Android framework components handling package installation dialogs
- Devices receiving the March 2025 Android Security Bulletin patch level
Discovery Timeline
- 2025-08-26 - CVE-2025-0080 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
- 2025-03-01 - Referenced in the Android Security Bulletin
Technical Details for CVE-2025-0080
Vulnerability Analysis
The vulnerability enables a tapjacking attack against Android's package installation confirmation dialog. A malicious application draws an overlay window on top of the legitimate installation prompt shown by the system. The user sees benign-looking UI elements while their taps are consumed by the underlying installation dialog. This grants elevated privileges to attacker-controlled packages through user consent that was never knowingly given.
The issue is classified as CWE-250 (Execution with Unnecessary Privileges), reflecting that the installation flow processes user input without adequately verifying that the taps originated from an uncovered, trusted surface. Because the exploitation path terminates in successful installation of a package, the impact chain reaches confidentiality, integrity, and availability of the device.
Root Cause
The root cause is the absence of overlay protection on sensitive system dialogs used during the package installation flow. Android supports filterTouchesWhenObscured and related touch-filtering mechanisms, but these were not consistently applied across the multiple locations where installation confirmation is presented. The Android framework code change referenced in the AOSP commit hardens these code paths.
Attack Vector
Exploitation requires a locally installed application with low privileges and the ability to draw overlays. The malicious app renders a transparent or decoy window over the installation confirmation dialog at the moment the system prompts the user. Taps intended for the decoy UI reach the underlying installation button, authorizing package installation or permission grants. No additional execution privileges and no direct user interaction with the malicious dialog element are required beyond routine on-screen activity.
A representative attack sequence involves the malicious app requesting overlay permission during install, monitoring for PackageInstaller activity launches, and animating a decoy overlay that aligns with the confirmation button. Refer to the Android Security Bulletin March 2025 for authoritative technical detail.
Detection Methods for CVE-2025-0080
Indicators of Compromise
- Applications holding the SYSTEM_ALERT_WINDOW permission that render overlays while PackageInstaller activities are foregrounded
- Unexpected package installations correlated with third-party app activity in logcat or MDM install logs
- Applications that programmatically launch install intents (ACTION_INSTALL_PACKAGE, ACTION_VIEW with APK MIME type) shortly after showing overlay windows
Detection Strategies
- Audit installed applications for those requesting overlay permissions combined with install-related intents
- Use mobile threat defense telemetry to flag apps that draw over system dialogs during sensitive workflows
- Correlate Android system logs showing overlay window creation with subsequent PackageManager install events
Monitoring Recommendations
- Track the Android security patch level via MDM and alert on devices below the March 2025 bulletin
- Monitor enterprise app inventory for newly installed packages that were not delivered through managed channels
- Review overlay permission grants in Android settings on a recurring basis for managed fleets
How to Mitigate CVE-2025-0080
Immediate Actions Required
- Apply the Android March 2025 security patch level or later to all affected Android 15 devices
- Revoke SYSTEM_ALERT_WINDOW (Display over other apps) permission from applications that do not require it
- Restrict installation of applications from unknown sources through MDM policy
Patch Information
Google addressed the vulnerability in the March 2025 Android Security Bulletin. The framework fix is available in the AOSP commit 5916a3d, which applies overlay protection to the affected installation confirmation surfaces. Device vendors distribute this patch through their standard OTA update channels; verify by checking that the device reports a security patch level of 2025-03-01 or later.
Workarounds
- Disable overlay permission for all non-essential applications until the patch is applied
- Enforce Google Play Protect and restrict sideloading through enterprise mobility management policies
- Educate users to cancel installation prompts that appear unexpectedly or contain misaligned UI elements
# Verify the Android security patch level on a device
adb shell getprop ro.build.version.security_patch
# Revoke overlay permission from a suspect package
adb shell appops set <package.name> SYSTEM_ALERT_WINDOW deny
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
