QSearchQSearch

CVE-2026-28577

7.8 HIGH

In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack

Published: 2026-06-01 · Last updated: 2026-06-03

Severity and scoring

CVSS
7.8 HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-1021

Affected products

VendorProduct
googleandroid

Description

In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-11701 — Inappropriate implementation in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via ... (5.4 MEDIUM)
  • CVE-2026-11700 — Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to ... (8.3 HIGH)
  • CVE-2026-11699 — Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corrupt... (8.8 HIGH)
  • CVE-2026-11698 — Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corrupt... (8.8 HIGH)
  • CVE-2026-11697 — Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perfor... (9.6 CRITICAL)

Same CWE

  • CVE-2026-0061 — In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overla... (5.9 MEDIUM)
  • CVE-2026-0036 — In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack (7.8 HIGH)
  • CVE-2026-21785 — A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to defin... (4.0 MEDIUM)
  • CVE-2026-9396 — A security flaw has been discovered in Besen BS20 EV Charging Station up to 20260426 (3.7 LOW)
  • CVE-2026-42502 — Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree (6.1 MEDIUM)