Cordova Plugin X Socialsharing
CVE-2025-65835
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses Intent.EXTRA_CHOSEN_COMPONENT without checking for null. If a broadcast is sent with extras present but without EXTRA_CHOSEN_COMPONENT, the code dereferences a null value and throws a NullPointerException. Because the receiver is exported and performs no permission or caller validation, any local application on the device can send crafted ACTION_SEND broadcasts to this component and repeatedly crash the host application, resulting in a local, unauthenticated application-level denial of service for any app that includes the plugin.
AnalysisAI
Local denial of service in cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) 6.0.4 for Android: the plugin registers an exported broadcast receiver (nl.xservices.plugins.ShareChooserPendingIntent) that dereferences Intent.EXTRA_CHOSEN_COMPONENT without a null check, so any other app on the device can crash the host application by sending a crafted ACTION_SEND broadcast without that extra. The flaw requires no permissions and no user interaction, and is reachable only on affected Android builds, so the impact is limited to availability (repeated application-level crashes) rather than data loss or code execution. Exploit code and a public write-up exist, but there is no evidence of this being exploited in the wild beyond proof-of-concept demonstration, and no CISA KEV listing.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today