Security researchers at TU Wien have uncovered a sophisticated new attack vector dubbed “TapTrap” that enables malicious Android applications to bypass the operating system’s permission system and execute destructive actions without user knowledge. Until Android implements these protections, users remain vulnerable to this sophisticated attack vector that undermines fundamental assumptions about mobile interface security. Unlike traditional tapjacking attacks that rely on overlaying malicious windows over legitimate apps, TapTrap leverages Android’s built-in activity transition animations to create a deceptive user interface. The attack exploits a previously unknown vulnerability in Android’s activity transition animations, affecting even the latest Android 15 release. Security researchers discover novel animation-based vulnerability affecting 76% of Android apps. The attack works by launching a transparent activity on top of a legitimate permission dialog or sensitive interface, making it nearly invisible to users while still capturing their touch inputs. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The research team analyzed 99,705 Android applications from the Google Play Store, revealing that 76.3% are vulnerable to TapTrap attacks.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 09 Jul 2025 09:50:10 +0000