CVE-2016-2496

CVE-2016-2496 is a critical tapjacking vulnerability affecting Android 6.x devices prior to the June 2016 security update. Attackers can exploit this flaw by creating a partially overlapping window, enabling them to access arbitrary private-storage files without user knowledge. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. While no public exploit code or active exploitation is reported, the vulnerability received notable media coverage and community discussion at the time.