CVE-2016-2496: Google Android

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by creating a partially overlapping window, aka internal bug 26677796.

Affected products

• Google Android: version 6.0 only; version 6.0.1 only

Published 2016-06-13. Last modified 2026-06-17.