CVE-2026-0007: Android Frameworks Native Package - Tapjacking Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2026-0007: In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. Affects platform/frameworks/native across 4 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Native package is a core component of the Android operating system, responsible for providing essential services and functionalities to applications. It facilitates interactions between the hardware and software layers, ensuring smooth operation of various applications. This package is critical for maintaining system integrity and security, making it vital to address any vulnerabilities that may arise within its codebase.
Vulnerability Detail
In the writeToParcel function of WindowInfo.cpp, a vulnerability exists that allows an attacker to exploit a tapjacking or overlay attack. This can trick users into granting permissions without their knowledge, leading to local escalation of privileges. The vulnerability does not require additional execution privileges or user interaction for exploitation, making it particularly dangerous.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid granting permissions to applications that exhibit suspicious behavior or overlay functionalities until the package is updated. Additionally, users can monitor their device for unusual permission requests.
Conclusion
The CVE-2026-0007 vulnerability in the Android Frameworks Native package poses a significant risk due to its ability to facilitate tapjacking attacks. It is crucial for developers and users to update their packages to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for platform/frameworks/native →
FAQ
CVE-2026-0007 is a vulnerability in the Android Frameworks Native package that allows for local privilege escalation through a tapjacking attack.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive permissions, potentially compromising user data and device security.
No, user interaction is not needed for exploitation, making it particularly concerning.
Update the Android Frameworks Native package to the latest patched version and monitor for any unusual permission requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/native.
