CVE-2026-0007
Google Android 14.0 … 16.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2026-0007 is a high-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Google Android. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-0007 is a vulnerability in the writeToParcel function of WindowInfo.cpp within the Android framework. It enables a tapjacking or overlay attack that could trick a user into accepting a permission, potentially leading to local escalation of privilege without requiring additional execution privileges. The issue has a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and is associated with CWE-1021.
A local attacker with no privileges can exploit this vulnerability due to its low attack complexity. Although the description states that user interaction is not needed for exploitation, the CVSS vector indicates user interaction is required (UI:R). Successful exploitation allows the attacker to achieve high confidentiality, integrity, and availability impacts with a changed scope, resulting in local privilege escalation.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 details patches and mitigation guidance for this vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9226
Vulnerability Data
In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
more
needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require implementing frame-ancestors / X-Frame-Options controls that prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing frame protections, but does not itself implement the control.
Web filtering can block or sandbox untrusted frames, but does not enforce application-level frame-busting or CSP.
Application security requirements can mandate frame-ancestors / X-Frame-Options, directly addressing UI redressing risks.
Secure architecture principles include isolation of UI layers and proper use of browser security controls.
Secure coding practices directly require implementation of frame-busting headers or CSP frame-ancestors directives.