CVE-2026-0036: In startAnimation of StageCoordinator

Synopsis

A privilege-escalation vulnerability exists in the startAnimation method of StageCoordinator.java in Android (versions 14, 15, 16, and 16-qpr2). An attacker with an existing low-privilege account on the device can exploit a tapjacking/overlay weakness to silently capture taps intended for other apps, without any user interaction required. Successful exploitation grants the attacker full read, write, and execution control at an elevated privilege level. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attack is local (AV:L); the attacker needs an existing shell or process on the host and does not require any network access.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must already have a foothold on the device but does not need administrative rights.

• Victim interactionNot required

  No user interaction is required for exploitation; the attacker can trigger the tapjacking condition without any social engineering or victim action.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory layout assumptions, or other environmental factors.

Blast Radius

• Reads sensitive data stored by other applications or the system, including credentials, session tokens, and private files.
• Writes or modifies data belonging to other applications or the system, including configuration and persisted user records.
• Executes code at an elevated privilege level, enabling the attacker to install malicious components or alter system behavior.
• Silently intercepts user taps intended for legitimate UI elements, redirecting actions to attacker-controlled surfaces without the user's knowledge.