PT-2026-135799

The ClusterRenderingService.dump method, accessible to processes holding android.permission.DUMP and android.permission.PACKAGE USAGE STATS, acts as a confused deputy. It allows attackers to write arbitrary values to Settings.Global.OVERLAY DISPLAY DEVICES, an operation normally requiring...