An elevation of privilege vulnerability in the Android DisplayPolicy component allows local applications to intercept sensitive drag-and-drop data without user interaction or special permissions.

The flaw exists in the validateAddingWindowLw function within DisplayPolicy.java, where a missing permission check enables an unprivileged local application to intercept system drag-and-drop events.

Successful exploitation of this vulnerability permits a malicious local application to capture data being transferred between other applications, leading to potential sensitive information disclosure or unauthorized actions. With a CVSS score of 8.4, this high-severity flaw poses a significant risk to data confidentiality and integrity on affected mobile devices, especially in environments where users install third-party applications.

Immediate Action: Apply the official security updates provided in the March 2026 Android Security Bulletin as soon as they are made available by your device manufacturer or service provider.

Proactive Monitoring: Monitor for suspicious application behavior, particularly applications requesting unusual accessibility or display-related permissions that could be used to facilitate such interception.

Compensating Controls: Maintain strict mobile device management (MDM) policies that restrict the installation of applications from untrusted or unknown sources to limit the attack surface.

Public Exploit Available: Unknown.

Given the potential for local privilege escalation and the lack of required user interaction, this vulnerability represents a serious security risk. Administrators and end users should prioritize the installation of the March 2026 security patches once deployed by their respective hardware vendors to remediate this flaw effectively.