CVE-2026-0048: Medium severity Google Android vulnerability
In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Revoke or disable the ability for apps to draw overlays (draw over other apps) for untrusted or unnecessary apps to mitigate tapjacking/overlay attacks that could trick users into approving permissions.
Overlay / draw-over-other-apps permission draw_over_other_apps = disabled - Compensating control
Restrict installation and execution of untrusted applications (for example via enterprise app whitelisting, MDM policies, or app-store protections) and limit which apps are allowed to create screen overlays.
- Operational
Audit installed applications for those holding overlay/draw-over-other-apps permissions and remove or revoke those permissions or uninstall apps that do not require them.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0048?
The severity of CVE-2026-0048 is rated as medium, with a CVSS score of 6.8.
How do I fix CVE-2026-0048?
To mitigate CVE-2026-0048, it is recommended to update your Google Android software to the latest version provided by the vendor.
What exploit does CVE-2026-0048 present?
CVE-2026-0048 presents a risk of local privilege escalation through a tapjacking overlay attack.
Is user interaction required for exploiting CVE-2026-0048?
No, user interaction is not required for the exploitation of CVE-2026-0048.
What impact does CVE-2026-0048 have on user permissions?
CVE-2026-0048 can trick users into approving permissions, compromising their device security.