CVE-2026-0007
Published: 02 March 2026
Summary
CVE-2026-0007 is a high-severity Improper Restriction of Rendered UI Layers or Frames (CWE-1021) vulnerability in Google Android. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2026-0007 is a vulnerability in the writeToParcel function of WindowInfo.cpp within the Android framework. It enables a tapjacking or overlay attack that could trick a user into accepting a permission, potentially leading to local escalation of privilege without requiring additional execution privileges. The issue has a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and is associated with CWE-1021.
A local attacker with no privileges can exploit this vulnerability due to its low attack complexity. Although the description states that user interaction is not needed for exploitation, the CVSS vector indicates user interaction is required (UI:R). Successful exploitation allows the attacker to achieve high confidentiality, integrity, and availability impacts with a changed scope, resulting in local privilege escalation.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 details patches and mitigation guidance for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9226
Vulnerability details
In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
more
needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via exploitation of overlay/tapjacking vulnerability in Android framework component.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific flaw in WindowInfo.cpp writeToParcel by applying patches from the Android security bulletin, preventing the tapjacking/overlay attack and subsequent privilege escalation.
Provides a trusted path for communications between the user and permission-granting security functions, reducing the effectiveness of overlay attacks that trick users into accepting permissions.
Enforces secure configuration settings on Android systems to restrict overlay permissions and window manipulation capabilities exploited by this vulnerability.