Share to Clipboard CVE-2026-107026

Exploitation requires local presence on the device running Share to Clipboard v1.14.1 (versionCode 32): a co-installed app or a separate Android user/profile that can reach the application's improperly protected component (CWE-732 insecure permissions). The concrete prerequisite is that the vulnerable app's component permissions allow an unauthorized party to invoke the clipboard-write functionality; the attacker does not need in-app privileges or user interaction, but does need to already be executing on the same device. Limiting factors: despite the CVSS AV:N rating this is not realistically remote/unauthenticated over a network, impact is confined to overwriting clipboard content (no read/confidentiality and no availability effect), and the target must have this specific niche app version installed.

The headline CVSS 3.1 base score of 7.5 is driven entirely by the network attack vector (AV:N) combined with no privileges and no user interaction (PR:N/UI:N) and a high integrity impact (I:H). That vector is internally inconsistent with the described mechanism: this is a CWE-732 insecure-permissions flaw in an Android application (F-Droid package com.tengu.sharetoclipboard) that lets one party overwrite 'another user's clipboard content.' Insecure Android component permissions are exploited by a co-located app or another local user on the same device, not over a network - so AV:N almost certainly overstates reachability and the realistic vector is local. No EPSS probability was supplied, the CVE is not on the CISA KEV list, and no confirmed proof-of-concept or working exploit code is indicated in the input; the only exploitation-relevant reference is a third-party advisory, not verified exploit code. The vuln.today decision label is 'this_week' rather than act_now/emergency. Net assessment: this is a high-CVSS-but-modest-real-risk issue - the inflated score comes from the questionable AV:N rating, the affected product is an obscure utility app, the impact is confined to clipboard-content integrity (C:N/A:N), and there is no evidence of active or automated exploitation. Explicit conflict to verify with the vendor/CVE source: CVSS says network vector but the insecure-permissions description implies local, on-device access.

A malicious or unprivileged app already installed on the same Android device (or a second local profile/user) abuses the insecure component permissions of Share to Clipboard v1.14.1 to write arbitrary data into another user's clipboard without authorization - a classic clipboard-hijacking primitive, e.g. silently swapping a copied value. No public exploit code is identified at time of analysis; only a third-party advisory reference exists. Because the true vector is local, an attacker must first have code running on the target device.