In 2022, Android faced a critical security flaw (CVE-2022-20448) that allowed screen readers like TalkBack to expose private notifications across multi-user sessions. This vulnerability, rooted in a missing permission check, created a blind spot in Android’s security model, enabling unauthorized data access. Discover how this flaw worked, its real-world impact, and the minimalist yet effective patch that closed the gap. Learn actionable steps to audit accessibility services and safeguard multi-user environments on Android devices.