IDnow App CVE-2025-7892

The primary remediation is for IDnow to release a patched version (9.6.1 or later) with corrected AndroidManifest.xml entries, explicitly setting android:exported='false' for all internal components and adding appropriate permission restrictions via android:permission attributes for any intentionally exported components. No vendor-released patch has been identified at the time of analysis, and the vendor has not responded to disclosure. Users should monitor the Google Play Store or IDnow's official channels for a security update and install it immediately once available. As a compensating control pending patching, users should restrict which other applications are installed on the same device, avoid sideloading untrusted APKs, and use device-level security features (work profiles, Knox security on Samsung devices) to isolate the IDnow app. Alternatively, organization administrators deploying IDnow for identity verification should consider device management policies that limit app installation to trusted sources. Note: Uninstalling and reinstalling the app will not resolve this issue as the vulnerability is embedded in the app binary itself. Developers integrating IDnow should verify IPC component security in future versions before deployment.