CVE-2026-0007: 
NixOS vulnerability analysis and mitigation

CVE-2026-0007 is a tapjacking/overlay vulnerability in Android's WindowInfo.cpp (writeToParcel function) that allows a malicious application to trick users into accepting permissions they did not intend to grant, leading to local escalation of privilege. It affects Google Android versions 14.0, 15.0, and 16.0. The vulnerability was published on March 2, 2026, with a patch released via the Android Security Bulletin on March 3, 2026. It carries a CVSS v3.1 base score of 8.6 (High) (Android Security Bulletin, Red Hat CVE).

The root cause is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), manifesting in the writeToParcel method of WindowInfo.cpp within the Android framework. An attacker can deploy a malicious overlay or tapjacking UI that obscures a legitimate permission dialog, causing the user's tap to be registered as consent for a permission the attacker controls. The attack vector is local, requires no elevated privileges, and while user interaction is technically required (the user must tap), the interaction is coerced through deception rather than informed consent. No public proof-of-concept code has been identified at this time (Android Security Bulletin, Feedly).

Successful exploitation results in local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS scope: Changed). An attacker who tricks a user into granting an unintended permission could gain access to sensitive device data, modify system state, or disrupt device functionality — all without requiring any pre-existing elevated privileges. The changed scope indicates that the impact extends beyond the attacker's initial privilege boundary, potentially affecting other components or data on the device (Android Security Bulletin).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of this report. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, Android Security Bulletin).

1. Develop or deploy a malicious app: The attacker creates or distributes an Android application capable of drawing overlays (using TYPE_APPLICATION_OVERLAY or similar window types) on affected Android 14.0, 15.0, or 16.0 devices.
2. Trigger a permission dialog: The malicious app waits for or triggers a scenario where a sensitive permission dialog is displayed to the user (e.g., camera, microphone, location access).
3. Deploy the overlay: The app renders a deceptive UI layer over the legitimate permission dialog using the tapjacking technique enabled by the flaw in WindowInfo.cpp's writeToParcel, obscuring the true nature of the permission request.
4. Capture user interaction: When the user taps what they believe is an innocuous UI element, the tap is registered on the underlying permission dialog, granting the attacker's app the desired elevated permission.
5. Leverage granted permission: With the unintended permission granted, the attacker's app accesses sensitive device resources (e.g., contacts, camera, location), escalating its effective privilege level (Android Security Bulletin).

• Application Behavior: Presence of apps requesting SYSTEM_ALERT_WINDOW or overlay permissions without a clear legitimate use case; apps that display unusual UI elements over system dialogs.
• Logs: Android system logs (logcat) showing unexpected window layer changes or overlay events coinciding with permission grant dialogs; entries from WindowManagerService indicating overlay windows from non-system apps during permission prompts.
• Permission Grants: Unexpected or anomalous permission grants in device permission logs (Settings > Apps > [App] > Permissions) for sensitive permissions (camera, microphone, location, contacts) that the user does not recall approving.
• Network: Unusual outbound data transfers from apps that recently received unexpected permission grants, potentially indicating data exfiltration following privilege escalation.

Google released a patch addressing CVE-2026-0007 in the Android Security Bulletin for March 2026 (patch level 2026-03-01), covering Android versions 14.0, 15.0, and 16.0. Device owners and administrators should apply the March 2026 Android security update as soon as it is available for their device. As a workaround, users should avoid installing applications from untrusted sources and review overlay permissions granted to installed apps (Settings > Apps > Special app access > Display over other apps). Enterprise administrators should consider enforcing policies that restrict overlay-capable applications on managed devices (Android Security Bulletin, CIS Advisory).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in Google Android OS, including CVE-2026-0007, that could allow for privilege escalation (CIS Advisory). Samsung also addressed the vulnerability in its own security update cycle, as noted in Samsung Mobile Security updates (Samsung Security). General community reaction has been measured, consistent with the low EPSS score and absence of active exploitation.