CVE-2025-32349 Overview
CVE-2025-32349 is a privilege escalation vulnerability in Google Android caused by a tapjacking/overlay attack condition affecting multiple locations in the platform framework. The flaw allows a local, low-privileged application to escalate privileges without requiring additional execution privileges and without user interaction for exploitation. The issue is tracked under CWE-1021: Improper Restriction of Rendered UI Layers or Frames and was addressed in the Android Security Bulletin September 2025. Affected versions span Android 13, 14, 15, and 16.
Critical Impact
A malicious local application can escalate privileges by overlaying UI elements on top of privileged prompts, resulting in high confidentiality, integrity, and availability impact.
Affected Products
- Google Android 13.0
- Google Android 14.0
- Google Android 15.0 and 16.0
Discovery Timeline
- 2025-09-04 - CVE-2025-32349 published to the National Vulnerability Database
- 2025-09-01 - Google releases fixes in the Android Security Bulletin September 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32349
Vulnerability Analysis
The vulnerability is a tapjacking/overlay flaw located in multiple components of the Android frameworks/base platform. Tapjacking occurs when a malicious application draws content on top of another application's user interface, tricking users into interacting with privileged UI elements they cannot see. Because the flaw appears in multiple locations, remediation required patches across several framework paths, referenced in the commits 394acf2aa1dade06c9cb2b98d92d6e585de31012 and e4a93e6ffdaf0e51c2effd26a222a4e0b66ea5cb. Successful exploitation yields local privilege escalation with high impact to confidentiality, integrity, and availability.
Root Cause
The root cause is insufficient restriction of rendered UI layers, classified under CWE-1021. Android permitted overlay windows to be drawn above sensitive system prompts, such as permission dialogs or consent screens, without blocking touch events reaching the underlying activity. An attacker-controlled overlay could obscure the true UI context while the user's taps were routed to a privileged operation beneath.
Attack Vector
The attack vector is local. A malicious application installed on the device must obtain the ability to draw overlays, either through the SYSTEM_ALERT_WINDOW permission or an equivalent primitive. The application then displays decoy UI on top of a sensitive Android prompt and induces the user, or system flow, to interact with the underlying control. No further user interaction beyond normal device use is required for exploitation. Patch details are available in the referenced Android platform commits.
Detection Methods for CVE-2025-32349
Indicators of Compromise
- Installed applications holding the SYSTEM_ALERT_WINDOW permission that also request sensitive runtime permissions such as ACCESSIBILITY_SERVICE, BIND_DEVICE_ADMIN, or storage access.
- Applications that draw overlays coincident with system permission dialogs, package installer prompts, or credential entry screens.
- Devices running Android 13, 14, 15, or 16 without the 2025-09-01 or later security patch level applied.
Detection Strategies
- Enumerate installed applications on managed devices and flag those declaring android.permission.SYSTEM_ALERT_WINDOW in their manifests.
- Use mobile threat defense telemetry to correlate overlay activity with sensitive UI events such as consent grants or admin activation.
- Audit Android security patch level (ro.build.version.security_patch) across the fleet and identify devices below 2025-09-01.
Monitoring Recommendations
- Ingest mobile device management (MDM) inventory into a SIEM and alert on installations of applications that request overlay and accessibility privileges together.
- Monitor Play Protect and vendor mobile telemetry for detections related to tapjacking or overlay abuse.
- Track compliance metrics for the Android September 2025 patch level rollout across owned and BYOD devices.
How to Mitigate CVE-2025-32349
Immediate Actions Required
- Apply the Android security patch level 2025-09-01 or later to all Android 13, 14, 15, and 16 devices.
- Restrict the SYSTEM_ALERT_WINDOW permission on managed devices through MDM policy where business needs allow.
- Review high-risk applications with overlay capability and remove those without a clear business justification.
Patch Information
Google addressed CVE-2025-32349 in the Android Security Bulletin September 2025. The fixes are implemented in two AOSP commits to platform/frameworks/base: 394acf2aa1dade06c9cb2b98d92d6e585de31012 and e4a93e6ffdaf0e51c2effd26a222a4e0b66ea5cb. Original equipment manufacturers (OEMs) integrate these fixes into device-specific builds; the effective fix is delivered when the device reports a security patch level of 2025-09-01 or later.
Workarounds
- Enable Android's built-in "Hide overlays" behavior, which suppresses overlay windows when sensitive permission dialogs are displayed.
- Instruct users to deny the "Display over other apps" permission for untrusted applications under Settings > Apps > Special app access.
- For enterprise fleets, deploy MDM configuration that blocks sideloading and enforces installation only from vetted application sources until patches are applied.
# Verify Android security patch level on a connected device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2025-09-01 (or later)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
