PT-2026-45571 · Google · Android

CVE-2026-0046 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description An issue exists in the InputInterceptor of Letterbox.java within the Framework component. The flaw involves incorrect restriction of visualized user interface layers, which allows a tapjacking or overlay attack. This occurs when a user is tricked into accepting a permission, potentially leading to a local escalation of privilege without requiring additional execution privileges. User interaction is not needed for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Clickjacking

Weakness Enumeration

CWE-269

CWE-1021

Related Identifiers

BDU:2026-07676

CVE-2026-0046

Affected Products

Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-0046 · Security Note
• https://source.android.com/docs/security/bulletin/2026/2026-06-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07676 · Security Note
• https://source.android.com/docs/security/bulletin/2026/2026-06-01?hl=ru · Note
• https://t.me/cveNotify/211682 · Telegram Post