PoC-in-GitHub

GitHub의 PoC 2026 CVE-2026-0009 2026-06-01 여러 위치에서 코드의 논리적 오류로 인해 tapjacking이 발생할 가능성이 있습니다. 이로 인해 추가 실행 권한 없이 로컬 권한 상승이 발생할 수 있습니다. 사용자 상호 작용은 필요하지 않습니다. cduram/NotCVE-2026-0009 CVE-2026-0013 2026-03-02 PickActivity.java의 setupLayout에서 confused deputy로 인해 DocumentsUI 앱으로 모든 활동을 시작할 수 있는 가능성이 있습니다...

CVE-2020-0014-Toast

CVE-2020-0014 Toast 再現 この脆弱性により、悪意のあるアプリはクリック可能な Toast ビューを構築することで、画面上でのユーザーの操作を傍受し、ユーザーのパスワードなどの機密情報を収集することができます。 影響範囲：Android 8.0、8.1、9、10 の各バージョン 実現可能性のみ検証しており、脆弱性が実際に引き起こし得る被害は検証していません release リンク 最新の Android Toast 脆弱性を利用した Tapjacking Android セキュリティ情報 CVE-2020-0014...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

cve-2026-0013-exploit

This repository does not have a README...

CVE-2026-28656

In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-28630

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28631

In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28572

In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28656

This vulnerability affects DeviceAdminAdd.java in Android Wear (disclosed in the 2026-09-01 security bulletin). Multiple functions are susceptible to a tapjacking/overlay attack , allowing a local escalation of privilege with only low privileges and user interaction required. The CVSS 3.1 score i...

EUVD-2026-73987

In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-28656

In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

EUVD-2026-73975

In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28631

In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28631

CVE-2026-28631 is a consent bypass vulnerability in Android's IntentForwarderActivity.java (specifically the buildMiniResolver method), exploitable via a tapjacking/overlay attack . The flaw allows local escalation of privilege without additional execution privileges and without user interaction....

CVE-2026-28630

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28630

CVE-2026-28630 affects the onCreate method of ContactsPickerActivity.kt in the Android framework, where a tapjacking/overlay attack can produce a misleading user interface, enabling local information disclosure with low privileges and no user interaction. The CVSS 3.1 score is 3.3 (Low) . CISA's ...

EUVD-2026-73974

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28572

In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28572

CVE-2026-28572 is an elevation of privilege vulnerability in the Android Framework component, specifically in the onCreate method of InstallLaunch.kt. A tapjacking/overlay attack can produce a misleading UI, enabling a local attacker to escalate privileges with no additional execution privileges ...

EUVD-2026-73945

In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...