EUVD-2026-113181
GHSA-hjxf-6wgx-5x27
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall co-located malicious app
-
ExploitQuery exported CardProvider URI
-
ExecutionRead entire flashcard database
-
ImpactExfiltrate user's memorization data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Improper export of Android components
|
| Exploitation Conditions | Requires a second, unauthorized app installed on the same device that queries the improperly exported CardProvider content provider of AnyMemo versionCode 20260730; no runtime permission, credentials, or user interaction are needed because the provider is exported without access controls. Exploitation is LIMITED to that specific AnyMemo build, is local to the device (not reachable over the network despite the input's AV:N), and exposes only flashcard/memorization content as a read - it does not grant write/integrity impact or access to unrelated device data. |
| Impact | The signals conflict sharply and the raw 9.1 overstates real-world priority. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, but the mechanism is CWE-926 (improper export of an Android component) in the CardProvider content provider - an exported-provider data leak is exploited by another app co-resident on the device, so AV:N is almost certainly wrong and should be AV:L; verify with the advisory. The vector's I:H is also inconsistent with the description, which states only arbitrary READ of flashcards (a confidentiality issue), implying I:N. EPSS is low (0.17%, 6th percentile) and the CVE is not listed in CISA KEV, yet the vuln.today Decision label is act_now; this is a genuine conflict - the act_now label is not corroborated by exploitation-probability or KEV evidence and appears driven by the nominal high CVSS rather than observed activity. Net: a real but modest confidentiality flaw in a niche app, not a widespread emergency; treat it as a routine mobile-app fix rather than a priority-one incident. |
| Exploit ScenarioDerived | A user has AnyMemo (versionCode 20260730) installed alongside a malicious or curious app on the same Android device. Because CardProvider is improperly exported, that other app queries the provider URI without requesting any permission and reads the user's entire flashcard/memorization database, then exfiltrates it. No working exploit code is confirmed in the input, though an independent F-Droid advisory documents the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Improperly exported Android content provider in AnyMemo build 20260730 lets any other app installed on the same device read the user's entire flashcard database without credentials or user interaction. The assessed exposure is local (AV:L) and confidentiality-only: an attacker gains read access to memorization content, not write/integrity impact or unrelated device data, and the raw CVSS 9.1 overstates real-world priority. No public exploit identified at time of analysis and EPSS is 0.17% (6th percentile), although vuln.today assigns an act_now decision label.
RemediationAI
No vendor-released patch identified at time of analysis. Developers should fix CardProvider by setting android:exported="false" (or removing the exported flag) if external access is not required, or by enforcing a signature-level permission and validating caller identity if it is; the trade-off is that legitimate third-party integrations would break unless granted the permission. Users should remove AnyMemo build 20260730 or avoid installing untrusted apps alongside it, since exploitation requires a second app on the same device; isolating the app in a separate Android work profile reduces cross-profile access but does not protect data from malicious apps installed in the same profile. Check the referenced advisory (https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107021.md) and F-Droid package page for a corrected build before reinstalling.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AnyMemo is an Android flashcard application distributed via F-Droid under package org.liberty.android.fantastischmemo. The flaw is CWE-926 (Improper Export of Android Application Components): the CardProvider content provider in versionCode 20260730 is exported without access controls, so a second, unauthorized app can query it through Android's ContentResolver and read the flashcard/memorization database. The supplied tag Authentication Bypass is consistent with a provider that lacks caller checks. No CPE mapping is supplied in the input; the confirmed affected build is versionCode 20260730. The trigger is a local malicious app querying the exported provider; no runtime permission, credentials, or user interaction are needed. The input's AV:N vector conflicts with the assessed AV:L vector; the confirmed exposure is device-local, not network-reachable, and does not grant write access or access to other app data.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
An exported content provider is reached by a co-located app, so AV:L not AV:N; no permission or interaction needed (PR:N/UI:N); description shows read-only data exposure, so C:H but I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.
Executive ViewAI
AnyMemo, a flashcard application, contains a critical vulnerability that allows any other app on the same Android device to read the user's entire flashcard database without authentication. This affects users who have installed other apps that may be malicious, potentially exposing sensitive study materials. While the CVSS score is 9.1, the actual risk is confined to local data confidentiality and should be prioritized accordingly.
No vendor-released patch identified at time of analysis. Interim mitigations include: uninstalling AnyMemo build 20260730 from all devices; using MDM to block the app; educating users about the risk of installing untrusted apps; and isolating sensitive data by avoiding storage of confidential information in AnyMemo.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB