CVE-2026-0009: MediaProvider Package Tapjacking Vulnerability
Summary
CVE-2026-0009: In multiple locations, there is a possible tapjacking due to a logic error in the code. Affects platform/packages/providers/MediaProvider across 3 version ranges.
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The MediaProvider package is an integral component of the Android ecosystem, responsible for managing and providing access to media files such as images, audio, and video. It facilitates the sharing and retrieval of media content across applications, ensuring a seamless user experience. However, this package has been identified as vulnerable to a tapjacking attack, which can lead to unauthorized privilege escalation.
Vulnerability Detail
The vulnerability arises from a logic error in the MediaProvider code, which allows for a possible tapjacking attack. This type of attack can enable an attacker to manipulate user interactions with the application, leading to local escalation of privileges without requiring additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly concerning.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is strongly recommended to update to the patched versions as soon as they are available.
Conclusion
The CVE-2026-0009 vulnerability in the MediaProvider package poses a significant risk due to the potential for tapjacking attacks that can escalate privileges without user interaction. It is crucial for developers and users to update their packages to the latest versions to mitigate this risk.
See every vulnerability recorded for platform/packages/providers/MediaProvider →
FAQ
Tapjacking is a malicious technique where an attacker overlays a transparent layer over a legitimate application, tricking users into clicking on hidden buttons or links.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
The vulnerability could lead to unauthorized privilege escalation, allowing attackers to gain access to sensitive information or perform actions on behalf of the user.
The best way to protect your application is to update the MediaProvider package to the latest patched version as soon as it becomes available.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/providers/MediaProvider.
