EUVD-2026-52340
GHSA-p4m6-fc2r-5pvm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because exploitation requires a co-installed app; PR:L since any installed application can send the Intent; no scope change and limited impact across all three pillars.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
AnalysisAI
Improper export of the DialerActivity component in textPlus Text Message and Call App (Android, versions up to 8.3.5) allows any co-installed application on the same device to invoke the com.gogii.textplus dialer component without authorization. Classified under CWE-926, this flaw permits a locally-present malicious app to trigger dialer functionality, leading to limited information disclosure and unauthorized interaction with call-related features. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions on the victim's Android device: (1) textPlus Text Message and Call App version 8.3.5 or earlier must be installed, and (2) a malicious co-installed application must be present and able to send Intents - achievable by sideloading or installing from an untrusted source. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.8 (Medium) with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N correctly reflects a strictly local attack requiring a low-privilege co-installed app - not a remote or zero-click threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been confirmed in the available data - users should check the Google Play Store for a textPlus update above version 8.3.5 and apply it immediately if available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today