CVE-2026-0036: High severity Google Android vulnerability
In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict or revoke apps' ability to create on-screen overlays (tapjacking). Remove the 'draw over other apps' / overlay permission from untrusted or unnecessary apps via OS settings or enterprise policy, and block apps from requesting this permission where possible.
- Compensating control
Prevent installation and execution of untrusted local apps that could provide overlay capability—disable installation from unknown sources or enforce app installation policies via MDM/endpoint management to limit potential overlay attackers.
- Operational
Audit devices for installed apps that hold overlay/draw-over-other-apps permission and uninstall or remediate any suspicious or unnecessary apps. Monitor for signs of local privilege escalation and review recent app installs and permissions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0036?
CVE-2026-0036 has a high severity rating of 7.8 according to the CVSS 3.1 scoring system.
What type of vulnerability is CVE-2026-0036?
CVE-2026-0036 is a tapjacking vulnerability that can lead to local escalation of privilege.
How does CVE-2026-0036 exploit user interaction?
CVE-2026-0036 does not require user interaction for exploitation, making it particularly dangerous.
Which software is affected by CVE-2026-0036?
CVE-2026-0036 affects Google Android devices.
How do I mitigate the risks associated with CVE-2026-0036?
To mitigate CVE-2026-0036, ensure that your Android device is updated with the latest security patches.