MotionCreative Motion UI CVE-2026-107048

The target must have MotionCreative Motion UI at exactly versionCode 101 installed on an Android device, and an attacker must be able to deliver a crafted POST request to the app's improperly exported WebView rendering component (CWE-926). Because the weakness is improper component export, the realistic prerequisite is a co-located malicious app (or other local party) able to invoke the exported component; whether remote attacker-controlled web content can reach the same path is not described in the available sources. Exploitation is bounded to this one specific build of a niche f-droid application and the resulting code execution runs within that app's sandbox and granted permissions; the exact trigger mechanism is not stated in the evidence.

Signals conflict sharply. The NVD CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) rates this critical and unauthenticated-remote, and the vuln.today decision label is act_now. However, EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit has been identified - so the quantitative exploitation signals are all low and contradict the act_now urgency. More importantly, the assigned weakness CWE-926 (Improper Export of Android Application Components) implies the realistic attack path is a co-located malicious app invoking an exported component, not a true network attacker, which suggests the AV:N in the NVD vector likely overstates reachability (AV:L is more defensible) - verify the actual trigger with the advisory. Combined with the product being an obscure f-droid Android app with a tiny install base, this reads as a high-CVSS-but-low-real-world-risk item for the overwhelming majority of environments; it would matter only to the small population that has this specific app (versionCode 101) installed. Treat the act_now label as a per-signal flag to patch the app, not as evidence of widespread or active exploitation.

A malicious application already present on the same device - or, per the improper-export weakness, any local party able to reach the exported component - delivers a crafted POST request into Motion UI's WebView rendering path, causing arbitrary code to run within the app's sandbox and permissions. No public exploit code has been identified, and the precise trigger (local app-to-app invocation versus attacker-controlled web content loaded by the WebView) is not described in the available sources.