CVE-2026-59006 in Android

Résumé

par MITRE • 02/11/2026

In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsable: Google Android
• Réserver: 02/07/2026
• Divulgation: 02/11/2026
• Modérer: accepté
• Entrée: VDB-430058
• CPE: 20261102
• CWE: CWE-200 (confirmé)
• CVSS: 2.8 (VulDB)
• EPSS: 0.00000
• KEV: non
• Activités: très faible
• Secteur: Insurance, Homeoffice, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-59006
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59006
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-59006/