CVE-2026-0009: In multiple locations, there is a possible tapjacking due to a logic error in the code

Synopsis

Tapjacking vulnerability in Google Android (versions 15 and 16) allows a local attacker to escalate privileges by exploiting a logic error in multiple UI overlay handling locations. The attack requires only a low-privilege local account and no victim interaction, and it runs entirely on the device without any network exposure. Successful exploitation gives the attacker high-level read, write, and execution control over the affected device. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code paths.

• AuthenticationRequired

  Any low-privilege account on the device is sufficient; no administrative or elevated credentials are needed to begin exploitation.

• Victim interactionNot required

  No user action such as clicking a link or approving a prompt is needed; the attacker can exploit the vulnerability without involving the device owner.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, specific memory layouts, or environmental prerequisites must be met by the attacker.

Blast Radius

• Reads sensitive data stored on the device, including credentials, tokens, and application data accessible at high confidentiality impact.
• Modifies files, application state, and system settings on the device due to high integrity impact.
• Disrupts or terminates running services and processes on the affected Android device due to high availability impact.
• Achieves effective local privilege escalation, gaining capabilities beyond the original low-privilege account without requiring any further execution privileges.