Tapjacking Overlay in Android Contacts Picker

Publication date: 2026-09-08

Last updated on: 2026-09-15

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-15

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-28630

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability involves a tapjacking or overlay attack in the ContactsPickerActivity.kt file. It allows an attacker to create a misleading user interface that tricks users into interacting with hidden elements, potentially leading to the disclosure of local information without needing additional execution privileges or user interaction.

Impact Analysis

This vulnerability could allow an attacker to trick you into revealing sensitive information by overlaying deceptive UI elements on top of legitimate ones. Since no special permissions or user interaction are required, it poses a risk of local data exposure on affected devices.

Mitigation Strategies

Apply the latest Android security update to patch the ContactsPickerActivity.kt tapjacking vulnerability. Disable overlays or screen-reading apps temporarily if they are not essential.

Hi! I’m here to help you understand CVE-2026-28630. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70