CVE-2026-28630 in Android
Summary
by MITRE • 09/08/2026
In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in the ContactsPickerActivity component represents a significant security flaw rooted in improper window management and user interface layering within Android applications. Specifically, during the onCreate lifecycle method, the application fails to implement adequate safeguards against overlay attacks, commonly referred to as tapjacking or clickjacking variants on mobile platforms. This architectural weakness allows malicious third-party applications with appropriate permissions to draw transparent overlays atop the legitimate ContactsPickerActivity window. By doing so, these malicious actors can intercept user touch events intended for the genuine application interface and redirect them to their own hidden UI elements. The core technical flaw lies in the absence of flags such as FLAG_NOT_TOUCH_MODAL or proper system-level protections that prevent other applications from drawing over this specific activity, thereby compromising the integrity of the input channel between the user and the app.
From an operational perspective, this vulnerability facilitates local information disclosure without requiring any additional execution privileges beyond those typically granted to standard third-party apps on Android devices. The attacker does not need root access or elevated system rights; instead, they rely solely on the ability to create overlay windows, a capability available to most applications that request the SYSTEM_ALERT_WINDOW permission. When a user interacts with the compromised ContactsPickerActivity, their taps are misdirected by the malicious overlay. This can lead to unintended actions such as selecting specific contacts, confirming permissions, or navigating through sensitive data selection processes without the user's explicit knowledge or consent. The lack of required user interaction for exploitation in some contexts implies that if combined with other social engineering tactics or automated triggers, the attack vector becomes highly efficient and difficult for end-users to detect visually.
This type of vulnerability aligns closely with CWE-1021: Improper Restriction of Rendered UI Layers or Frames, which describes scenarios where an application fails to protect its user interface from being manipulated by external overlays. Furthermore, it maps directly to the MITRE ATT&CK for Mobile framework under the technique T1568.003: Dynamic Data Manipulation via Overlay Attacks. The exploitation of this flaw allows attackers to bypass intended security controls and user consent mechanisms embedded within the application's UI flow. By deceiving the user into interacting with hidden or misaligned buttons, the attacker can extract sensitive contact information that was never meant to be shared outside the context in which it was displayed. This undermines the principle of least privilege by allowing data exfiltration through deceptive interface manipulation rather than direct API exploitation.
Mitigation strategies must focus on hardening the application's UI layer against external interference. Developers should implement robust checks within the onCreate method and subsequent lifecycle stages to detect if an overlay is present or if the window flags are being manipulated incorrectly. Utilizing Android's built-in security features, such as setting the FLAG_NOT_TOUCH_MODAL flag appropriately or employing system-level protections like Secure Flag for sensitive activities, can prevent unauthorized touch interception. Additionally, integrating runtime checks that verify the integrity of the current UI context before processing user input is essential. Regular code audits focusing on window management and permission handling will help identify similar vulnerabilities across other components of the application ecosystem. Ensuring compliance with industry standards for mobile security design patterns will significantly reduce the attack surface associated with interface manipulation attacks.