How to Inspect Active Accessibility Services and Touch Listeners on Android Using ADB dumpsys accessibility

The Android Accessibility framework empowers users with motor, cognitive, or visual impairments by allowing specialized services (such as TalkBack, Switch Access, and screen readers) to inspect active window content, synthesize speech, simulate taps, and interpret touch gestures. However, because Accessibility services possess near-total visibility into rendered screen elements\u2014including reading sensitive text fields, bypassing confirmation dialogues, and logging keystrokes\u2014unauthorized or malicious applications frequently abuse Accessibility permissions to perform overlay attacks and screen scraping. To inspect active accessibility services, audit window interaction nodes, and detect rogue listeners, the Android Debug Bridge (ADB) provides dumpsys accessibility.

Understanding Android Accessibility Architecture and Capabilities

The system accessibility service (AccessibilityManagerService) manages interactions between the UI layer and registered accessibility clients:

• Feedback Types: Dictates how the service interacts with the user (e.g., FEEDBACK_SPOKEN for audio screen readers, FEEDBACK_GENERIC, or FEEDBACK_VISUAL).
• Capability Flags: Identifies high-risk privileges granted to the service, such as canRetrieveWindowContent (inspecting DOM/view hierarchies and text), canPerformGestures (simulating taps and swipes), and canRequestFilterKeyEvents (intercepting hardware keyboard inputs).
• Touch Exploration: A mode where the touchscreen acts as a virtual cursor rather than firing standard direct touch taps.
• Accessibility Button & Shortcuts: System navbar controls or volume-key combinations configured to activate accessibility utilities.

Generating an Accessibility Diagnostics Dump

To inspect the entire accessibility subsystem across all user accounts on a connected Android device, execute:

adb shell dumpsys accessibility

The output reports user state, installed accessibility services, active connections, and touch interaction parameters.

Auditing Active and Enabled Accessibility Services

To identify which services are actively running and holding inspection hooks into the operating system:

adb shell dumpsys accessibility | grep -A 20 "Enabled accessibility services:"

The diagnostic log exposes the registered package components:

Enabled accessibility services:
  {com.google.android.marvin.talkback/com.google.android.marvin.talkback.TalkBackService}
  {com.example.maliciousapp/com.example.maliciousapp.MyAccessibilityService}

To inspect granular capabilities granted to an individual service (e.g., com.example.maliciousapp):

adb shell dumpsys accessibility | grep -A 15 "com.example.maliciousapp"

Examine the reported capability flags:

Service[label=Security Helper, feedbackType=FEEDBACK_GENERIC, capabilities=19]
  canRetrieveWindowContent=true
  canPerformGestures=true
  canRequestFilterKeyEvents=true
  interactiveUiTimeout=0
  nonInteractiveUiTimeout=0

If an unknown application possesses canRetrieveWindowContent=true and canRequestFilterKeyEvents=true, it has the ability to read passwords, copy clipboard entries, and simulate user approval taps automatically.

Auditing Touch Exploration and Input Filter States

Malware often enables Touch Exploration mode or attaches input filters to intercept hardware inputs before applications can receive them:

adb shell dumpsys accessibility | grep -E "Touch exploration|Input filter"

The output reveals:

Touch exploration enabled: false
Display magnification enabled: false
Input filter installed: false

If Input filter installed returns true while no legitimate accessibility tool is running, a background process is actively intercepting and filtering low-level Linux evdev input events.

Disabling Rogue Accessibility Services via ADB

If an application locks out touch controls or refuses to be disabled through the standard Settings screen, disable it immediately using the settings shell command via ADB:

First, inspect the active enabled services string:

adb shell settings get secure enabled_accessibility_services

To completely disable all third-party accessibility services across the device:

adb shell settings put secure enabled_accessibility_services 'null'
adb shell settings put secure accessibility_enabled 0

To disable a specific rogue package while preserving legitimate tools like TalkBack:

adb shell settings put secure enabled_accessibility_services com.google.android.marvin.talkback/com.google.android.marvin.talkback.TalkBackService

The rogue service loses its window inspection privileges immediately without requiring a device restart.