Which versions of Google are affected by CVE-2026-9219?

Setracker2 Android app (versions 3.1.5 and prior) allows unauthenticated remote attackers to hijack GPS smartwatches and access real-time location data by guessing predictably-derived registration…

How to fix or mitigate CVE-2026-9219?

Within 24 hours: Audit all Setracker2 deployments, document affected versions, and identify high-priority targets (child tracking, field operations). Within 7 days: Notify users of compensating controls (disable location sharing, restrict device visibility, monitor account access); contact vendor for patch release timeline and escalate within your organization's vulnerability management process. Within 30 days: Pilot alternative smartwatch platforms with stronger enrollment controls; initiate migration planning if vendor patch remains unavailable beyond 60 days.

Google CVE-2026-9219

Q: What is the CVSS score of CVE-2026-9219?

CVE-2026-9219 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39591 HIGH

Generation of Predictable Numbers or Identifiers (CWE-340)

2026-06-26 ics-cert@hq.dhs.gov

GHSA-jpv7-7g7j-hgwr

Information Disclosure Google

8.3

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 00:31 vuln.today

CVE Published

Jun 26, 2026 - 00:16 cve.org

HIGH 8.3

DescriptionCVE.org

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.

AnalysisAI

Unauthorized device enrollment in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets remote attackers hijack other users' GPS smartwatches by guessing their registration ID. The registration ID is predictably derived from the device IMEI, and the enrollment workflow performs no secondary authentication before binding a watch to an account, so an attacker who learns or calculates the ID can take over the target's tracker. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Audit all Setracker2 deployments, document affected versions, and identify high-priority targets (child tracking, field operations). …

Threat intelligence, references, and detailed analysis are available after sign-in.