Skip to main content

Myna Point CVE-2026-73335

| EUVDEUVD-2026-66243 MEDIUM
Improper Authorization in Handler for Custom URL Scheme (CWE-939)
2026-08-26 jpcert
Google Information Disclosure Android App Myna Point
4.6
CVSS 4.0 · Vendor: jpcert
Share

Severity by source

Vendor (jpcert) PRIMARY
4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Local attack vector requires malicious app co-installation; PR:N because Android Intent dispatch needs no elevated permissions; UI:R because victim must interact with the device or app to trigger exploitation.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
CVSS changed
Aug 26, 2026 - 15:52 NVD
5.3 (MEDIUM) 4.6 (MEDIUM)
Analysis Generated
Aug 26, 2026 - 05:43 vuln.today
CVE Published
Aug 26, 2026 - 04:54 cve.org
MEDIUM 5.3

DescriptionCVE.org

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.

AnalysisAI

Improper authorization in Myna Point's Android Intent handler allows a co-installed malicious application to invoke the app's custom URL scheme handler without caller validation, triggering arbitrary JavaScript execution within the app's WebView context. All versions of the Japanese government digital identity application (Digital Agency, CPE wildcard) appear affected per JVN advisory JVN67155805. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker distributes malicious Android app
Delivery
Victim installs malicious app on Myna Point device
Exploit
Malicious app sends crafted Intent to Myna Point URL scheme handler
Execution
Handler passes attacker data to WebView without authorization check
Persist
Arbitrary JavaScript executes in Myna Point app context
Impact
App data or session state accessed or manipulated
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a malicious Android application to be installed on the same physical device as Myna Point. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L scores 5.3 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker publishes a malicious Android application - potentially disguised as a utility or game - and convinces a Myna Point user to install it via side-loading or a deceptive Play Store listing. Once co-installed, the malicious app sends a crafted Intent targeting Myna Point's exported URL scheme handler, injecting a JavaScript payload that executes within the Myna Point WebView context, potentially accessing session tokens, displayed government data, or manipulating the app's displayed content.
Remediation Users should update Myna Point to the latest version available through the Google Play Store, as the Digital Agency is expected to have released a corrected version addressing the Intent handler authorization flaw - consult the JVN advisory at https://jvn.jp/en/jp/JVN67155805/ for the confirmed fixed version, which is not specified in currently available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-939 – Improper Authorization in Handler for Custom URL Scheme

View all
CVE-2026-53407 CRITICAL
9.8
CVE-2026-35394 HIGH
8.8
CVE-2023-43582 HIGH
8.8
CVE-2026-6445 HIGH
8.7
CVE-2024-33606 HIGH
8.6
CVE-2026-53408 HIGH
8.1
CVE-2026-1046 HIGH
7.6
CVE-2026-3471 MEDIUM
6.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-73335 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy