CVE-2026-0061: Android Platform Frameworks Base - Tapjacking Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2026-0061: In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. Affects platform/frameworks/base across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android platform frameworks base is a core component of the Android operating system, responsible for providing essential services and APIs to applications. It facilitates interaction between the hardware and software layers, enabling developers to create robust applications. However, vulnerabilities within this framework can lead to significant security risks, including unauthorized access and privilege escalation.
Vulnerability Detail
In multiple functions of WindowState.java, there exists a vulnerability that allows an attacker to exploit a tapjacking or overlay attack. This vulnerability can trick users into granting permissions without their knowledge, leading to local escalation of privileges. The exploitation does not require any additional execution privileges and can occur without user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the permissions granted to applications and avoid installing apps from untrusted sources. Additionally, users should be cautious of overlays and ensure that they are aware of the permissions they are granting.
Conclusion
The CVE-2026-0061 vulnerability in the Android platform frameworks base poses a significant security risk due to its potential for local privilege escalation through tapjacking attacks. Users are strongly advised to update to the patched version to safeguard their applications and data.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-0061 is a vulnerability in the Android platform frameworks base that allows for local privilege escalation through tapjacking or overlay attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive information and the ability for attackers to escalate privileges without user consent.
Yes, a patch is available. Users should update to the fixed version of the Android platform frameworks base to mitigate the vulnerability.
If you cannot apply the patch immediately, consider limiting app permissions and being cautious about the apps you install until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
