CVE-2026-28577 Overview
CVE-2026-28577 is a tapjacking vulnerability in the Android WindowManagerService component. The flaw exists in the addWindow function of WindowManagerService.java and allows a malicious application to overlay deceptive UI elements on top of legitimate windows. An attacker leveraging this issue can trick users into performing actions that grant elevated privileges to an attacker-controlled application. Exploitation requires local access through an installed application but does not require any additional execution privileges or user interaction beyond normal device usage. Google addressed the issue in the Android Security Bulletin June 2026. The weakness is classified as [CWE-1021] (Improper Restriction of Rendered UI Layers or Frames).
Critical Impact
A local application can perform a tapjacking/overlay attack to achieve local privilege escalation on Android 14, 15, and 16 devices without requiring user interaction.
Affected Products
- Google Android 14.0
- Google Android 15.0
- Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3)
Discovery Timeline
- 2026-06-01 - Google publishes Android Security Bulletin including patch
- 2026-06-01 - CVE-2026-28577 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-28577
Vulnerability Analysis
The vulnerability resides in the addWindow method of WindowManagerService.java, the Android system service responsible for managing window creation, ordering, and visibility. The method fails to enforce sufficient restrictions on overlay windows that obscure security-sensitive UI elements. An attacker can register a window that visually covers system prompts or permission dialogs while passing user taps through to the underlying window. This class of attack is commonly referred to as tapjacking or UI overlay abuse.
Because the overlay decision occurs at the window manager level, applications without elevated permissions can position content above privileged system dialogs. The user perceives the attacker's interface while interacting with the system UI underneath. This allows the attacker to obtain consent or input the user never intended to provide.
Root Cause
The root cause is improper restriction of rendered UI layers ([CWE-1021]) inside WindowManagerService.addWindow. The window layering logic does not adequately validate or block untrusted overlay windows when sensitive system windows are present. Android's existing FLAG_WINDOW_IS_OBSCURED and filterTouchesWhenObscured protections are insufficient against the bypass enabled by this code path.
Attack Vector
The attack vector is local. An adversary must convince the target user to install a malicious application on the device. Once installed, the application creates overlay windows that align with privileged system prompts such as permission grants, accessibility service approvals, or device administrator activation. The user taps what appears to be a benign interface, but the input is delivered to the underlying system dialog. This grants the malicious app elevated permissions and a path to broader privilege escalation. No additional execution privileges are required, and the attack proceeds without explicit user interaction beyond normal screen taps.
No public proof-of-concept exploit is currently available for CVE-2026-28577.
Detection Methods for CVE-2026-28577
Indicators of Compromise
- Installation of applications requesting the SYSTEM_ALERT_WINDOW permission outside of expected business use cases.
- Applications that activate accessibility services or device admin shortly after installation, particularly from non-Play Store sources.
- Unexpected overlay windows appearing during permission grant flows or system dialogs.
Detection Strategies
- Audit installed applications for those holding overlay-related permissions and correlate with recently granted dangerous permissions.
- Monitor Android logs for repeated addWindow calls from non-system UIDs creating TYPE_APPLICATION_OVERLAY windows.
- Use mobile threat defense tooling to identify apps employing tapjacking patterns or sideloaded packages of unknown provenance.
Monitoring Recommendations
- Forward Android device telemetry to a central logging platform and alert on grants of accessibility, device admin, or SYSTEM_ALERT_WINDOW permissions.
- Track Android security patch level (ro.build.version.security_patch) across the fleet to identify devices missing the June 2026 patch.
- Inventory sideloaded APKs and packages installed from unknown sources for follow-up review.
How to Mitigate CVE-2026-28577
Immediate Actions Required
- Apply the Android security patch level dated 2026-06-01 or later on all managed devices.
- Restrict installation of applications from unknown sources through mobile device management (MDM) policies.
- Review and revoke SYSTEM_ALERT_WINDOW, accessibility service, and device administrator privileges from untrusted applications.
Patch Information
Google released the fix as part of the June 2026 Android Security Bulletin. Devices running the 2026-06-01 security patch level or later are protected. Refer to the Android Security Bulletin June 2026 for vendor-specific update guidance. OEMs and carriers distribute these patches on their own schedules, so verify availability with the device vendor.
Workarounds
- Disable the Display over other apps permission for all non-essential applications through device settings or MDM.
- Enable Google Play Protect to detect and block known malicious applications that abuse overlay permissions.
- For enterprise deployments, enforce a managed app catalog and block installation from unknown sources until the device receives the June 2026 patch.
# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-06-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
