CVE-2020-27059: 
NixOS vulnerability analysis and mitigation

CVE-2020-27059 is a fingerprint-jacking vulnerability discovered in Android's AuthenticationClient.java component, specifically in the onAuthenticated function. The vulnerability allows for a potential tapjacking attack when requesting the user's fingerprint due to an overlaid window. This security issue was disclosed in December 2020, with a patch scheduled for release in the January 2021 Android Security Bulletin (Dark Reading).

The vulnerability exists in the authentication process of Android devices, specifically in the onAuthenticated function of AuthenticationClient.java. The core issue involves a tapjacking attack vector that exploits the fingerprint authentication UI by allowing malicious overlay windows to potentially intercept or manipulate the fingerprint authentication process (NVD).

The vulnerability could allow attackers to perform tapjacking attacks during fingerprint authentication processes, potentially compromising the security of fingerprint-based authentication on affected Android devices (Dark Reading).

During an evaluation of 1,630 apps, researchers identified the potential for exploitation of this vulnerability through fingerprint-jacking attack techniques (Dark Reading).

A patch for this vulnerability was scheduled to be released in the January 2021 Android Security Bulletin (Dark Reading).