CVE-2025-32350 Overview
CVE-2025-32350 is a tapjacking/overlay vulnerability in the Android ControlsSettingsDialogManager.kt component. The flaw resides in the maybeShowDialog function, which fails to protect the ControlsSettingsDialog from being obscured by malicious overlays. An attacker with local access can exploit this weakness to achieve local privilege escalation without requiring additional execution privileges. Google addressed the issue in the Android Security Bulletin published on September 1, 2025.
Critical Impact
A local application can overlay the Controls settings dialog to trick users into granting elevated privileges, resulting in local escalation of privilege on affected Android devices.
Affected Products
- Google Android 14
- Google Android 15
- Google Android 16
Discovery Timeline
- 2025-09-04 - CVE-2025-32350 published to the National Vulnerability Database (NVD)
- 2025-09-01 - Google publishes the Android Security Bulletin containing the fix
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32350
Vulnerability Analysis
The vulnerability is classified under CWE-1021: Improper Restriction of Rendered UI Layers or Frames. It affects the maybeShowDialog method of ControlsSettingsDialogManager.kt in the Android system framework. The dialog is presented to users when configuring device controls, including granting sensitive permissions. Because the dialog does not enforce protections against being overlaid by other windows, a malicious application can render deceptive content on top of the legitimate prompt. This class of attack, known as tapjacking, tricks users into interacting with hidden UI elements that grant privileges to the attacker.
Root Cause
The root cause is the absence of overlay protection flags such as setFilterTouchesWhenObscured(true) or the FLAG_WINDOW_IS_OBSCURED check in the dialog rendering logic. Without these safeguards, touch events pass through overlay windows to the underlying settings dialog, letting an attacker capture consent gestures intended for the legitimate UI.
Attack Vector
Exploitation requires local access and low-privileged code execution on the device. A malicious application with the SYSTEM_ALERT_WINDOW permission or equivalent overlay capability can draw content over the ControlsSettingsDialog at the moment it is displayed. User interaction is not required to initiate the overlay, though the user unknowingly interacts with the legitimate dialog through the malicious overlay. The result is unauthorized privilege elevation within the device's control surface. Technical details are available in the Android source code update.
Detection Methods for CVE-2025-32350
Indicators of Compromise
- Installed applications requesting the SYSTEM_ALERT_WINDOW permission without a clear functional need
- Unexpected changes to device controls settings or permissions granted to third-party applications
- Applications drawing overlays during system settings interactions
Detection Strategies
- Audit installed applications for overlay permissions using Android's Settings > Apps > Special app access > Display over other apps
- Review Mobile Device Management (MDM) telemetry for applications that request overlay capabilities on devices running Android 14, 15, or 16
- Correlate application install events with subsequent modifications to device control settings
Monitoring Recommendations
- Enroll Android devices in an MDM solution that reports the Android security patch level and flags devices below the 2025-09-01 patch level
- Monitor for sideloaded APKs, particularly those requesting overlay or accessibility permissions
- Alert on privilege changes and permission grants originating from user interactions with settings dialogs
How to Mitigate CVE-2025-32350
Immediate Actions Required
- Apply the Android security patch dated 2025-09-01 or later on all affected devices
- Verify the current Android security patch level under Settings > About phone > Android version
- Restrict installation of applications from unknown sources across the mobile fleet
- Review and revoke unnecessary SYSTEM_ALERT_WINDOW permissions from third-party applications
Patch Information
Google released the fix in the Android Security Bulletin September 2025. The corresponding code change is available in the Android Open Source Project commit 47424521. Device manufacturers distribute the patch through their standard update channels; administrators should confirm downstream availability with each OEM.
Workarounds
- Disable the "Display over other apps" permission for all non-essential applications until the patch is applied
- Enforce Google Play Protect scanning to reduce the risk of installing malicious overlay-capable applications
- Use enterprise mobility management policies to block installation of applications requesting overlay permissions on unpatched devices
# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-09-01 or later
# List applications holding SYSTEM_ALERT_WINDOW permission
adb shell dumpsys package | grep -B2 "android.permission.SYSTEM_ALERT_WINDOW"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
