CVE-2026-28577: In addWindow of WindowManagerService

Synopsis

This is a local privilege escalation vulnerability in the Android WindowManagerService component, specifically in its addWindow function. An attacker with a low-privilege account already present on the device can exploit a tapjacking and overlay attack without any user interaction or additional permissions. Successful exploitation gives the attacker full control over the device, including read and write access to protected data and the ability to disrupt running services. No fix version has been published yet; HarborGuard tracks this advisory and will flag a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege account on the device is sufficient; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No user interaction of any kind is required for exploitation.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental factors need to be arranged.

Blast Radius

• Reads protected files, credentials, and application data stored on the device.
• Writes or overwrites protected system and application data, enabling persistent tampering.
• Crashes or disrupts running services on the device.
• Escalates from a low-privilege process to full device control by abusing the overlay attack surface in WindowManagerService.