Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Android framework can be tricked into granting higher privileges

CVE-2021-0438 · published 5 years ago
Summary

The core Android system code that handles screen touches may misinterpret a security flag, allowing a malicious app to overlay fake buttons and capture user taps. This could let a lower‑privileged app obtain the same rights as higher‑privileged components after a user taps, without needing extra code execution. Install updates from Google or apply the provided patch to correct the flag handling, and avoid running untrusted apps.

What to do
  • Update google platform/frameworks/base to version 8.1:2021-04-01.
  • Update google platform/frameworks/base to version 9:2021-04-01.
  • Update google platform/frameworks/base to version 10:2021-04-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/frameworks/base >= 8.1:0, < 8.1:2021-04-01
>= 9:0, < 9:2021-04-01
>= 10:0, < 10:2021-04-01
Fix: upgrade to 8.1:2021-04-01
– google android 8.1
9.0
10.0
cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*
Original advisory text
In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local es...
In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
References
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1021Improper Restriction of Rendered UI Layers or Frames
Timeline
Published1 Apr 2021
Updated2 Nov 2026
First seen3 Sep 2026
Sources
ASB-A-152064592 · OSV
CVE-2021-0438 · NVD
Track software like this
Free during beta