Shelter CVE-2026-107058

Exploitation requires the ability to register an attacker-controlled auth_key against Shelter's binder service, which implies a locally present/co-resident Android app able to reach that binder interface on a device where Shelter (versionCode 445) is installed and in use for profile isolation. The practical limiting factor is this local presence requirement: despite the NVD AV:N rating, the binder service API named in the description is on-device IPC, so a purely remote network attacker is not clearly supported by the evidence. No elevated privileges or user interaction beyond having the malicious component on the device are described; the exact trigger for how the auth_key is registered is not detailed in the available sources.

The NVD CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rates this as critical and remotely exploitable, and the vuln.today Decision label is act_now, so by the input's own decision signals this is a high-priority item to remediate now. However, the signals conflict on mechanism: the description describes an Android app (Shelter, net.typeblog.shelter) where an attacker registers their own auth_key to take over another user's binder service API and preference state - binder is local on-device IPC, which implies a local/co-resident-app attack vector rather than the network vector the CVSS AV:N claims. This AV:N-vs-local discrepancy should be verified with the advisory/vendor, because it materially changes who can exploit it (any device holding a malicious app vs. a remote network attacker). No CISA KEV listing is present and no EPSS score was supplied, so exploitation-probability and active-exploitation signals are absent - the urgency rests on the act_now label and the authentication-bypass impact, not on observed exploitation. Net: a genuinely serious isolation/authentication-bypass flaw for users of this specific app, but its 'network' framing is likely overstated and its real-world footprint is small.

A malicious or co-resident Android app on a device running Shelter (versionCode 445) registers its own auth_key against Shelter's binder service, defeating the authentication that is supposed to bind the service to the legitimate profile. The attacker then assumes control of another user's binder service API and preference state, breaking the work-profile isolation Shelter is meant to enforce. No special attacker privileges are indicated, but the attack realistically requires local presence on the device.