CVE-2026-0046
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
An attacker can display an overlay that intercepts user touches, potentially leading to unintentional permission grant and privilege escalation.
Recommendation
Secure the InputInterceptor mechanism against overlay attacks and apply the appropriate security patch.
Other vulnerabilities in Android
See all- CVE-2016-0833High
Android allows users to cause a denial of service.
- CVE-2025-48595HighActively exploited
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.
- CVE-2025-48626Critical
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2016-3877Critical
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
- CVE-2026-49189High
Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.
- CVE-2026-24088High
A cryptographic issue while processing a specific partition allows unauthorized write access to load a customized bootloader.
- CVE-2026-28586Low
In multiple functions of AppOpsService.java, there is a missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed.
- CVE-2026-28581Medium
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, a logic error allows making an emergency call without proper privileges.
- CVE-2026-28580High
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.
- CVE-2026-28578Medium
In multiple functions of DevicePolicyManagerService.java, a desync from persistence due to improper input validation could lead to local denial of service.
Original NVD description (English source)
In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.