Myna Point CVE-2026-73335

Exploitation requires a malicious Android application to be installed on the same physical device as Myna Point. The malicious application must be capable of sending an Android Intent to Myna Point's exported custom URL scheme handler component - no special Android permissions are required for this action (PR:N in CVSS), as Intent dispatch between applications is a standard Android capability. User interaction is required per the CVSS UI:R metric, likely meaning the victim must launch Myna Point or interact with the device after the malicious Intent is sent. Exploitation is limited to the local device context (AV:L) and cannot be triggered remotely over a network. The attack does not apply to iOS or web deployments. Non-default conditions limiting exploitation: the victim must install a malicious third-party application alongside Myna Point, which is the primary barrier to mass exploitation.

The CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L scores 5.3 (Medium). The local attack vector is the dominant risk-reduction factor - exploitation requires a malicious Android application already installed on the victim's device, limiting the attacker pool to those who can socially engineer app installation outside of or alongside the Play Store. UI:R further indicates user interaction is required. Impact is uniformly Low across confidentiality, integrity, and availability, meaning an attacker cannot immediately extract credentials or fully compromise the device. No KEV listing and no POC availability data are provided, suggesting no confirmed active exploitation at time of analysis. EPSS data is absent from the provided intelligence; without it, exploitation probability cannot be quantified numerically. The realistic threat actor is a malicious Android app distributed via side-loading or a compromised store listing, targeting Japanese residents who use the Myna Point government identity portal - a targeted but plausible threat given the sensitive nature of the app (My Number Card authentication).

An attacker publishes a malicious Android application - potentially disguised as a utility or game - and convinces a Myna Point user to install it via side-loading or a deceptive Play Store listing. Once co-installed, the malicious app sends a crafted Intent targeting Myna Point's exported URL scheme handler, injecting a JavaScript payload that executes within the Myna Point WebView context, potentially accessing session tokens, displayed government data, or manipulating the app's displayed content.