Monthly
Ekia File Manager 1.2.7 for Android ships an exported ContentProvider (com.ekia.filecontrolmanager.OpenFileProvider) that declares no android:permission, readPermission, or writePermission, so any other app on the same device can invoke it. The provider maps the caller-supplied URI path straight to a filesystem path and passes it to new File(...), letting a malicious local app make the File Manager process read, create, overwrite, or delete every file that process can reach. The issue is not in CISA KEV, EPSS is only 0.11% (2nd percentile), and no public exploit tooling was identified in the supplied data, so real-world priority depends almost entirely on whether untrusted apps can be installed on the target device.
Improper export of Android application components in Lenovo File Manager (Chinese-market distribution) enables a locally authenticated user or co-installed application to read or modify files that the application designates as protected. The root cause is CWE-926, where one or more Android components - likely a content provider or activity - are exported without enforcing the application's own authorization logic. No public exploit code exists and the vulnerability has not been added to CISA KEV; however, the CVSS 4.0 score of 8.4 reflects genuine high-impact file access if an attacker can install a companion malicious application on the target device.
Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.
Location spoofing in the Home Assistant Android companion app prior to 2026.5.3 allows any co-installed application - even one with zero runtime permissions - to forge the device's reported GPS position by broadcasting a crafted Google Play Services LocationResult to an unprotected exported BroadcastReceiver. The forged coordinates are forwarded to the user's Home Assistant server as the device's real location, defeating Android's developer-mode Mock Location gate and enabling abuse of zone-based automations such as unlocking doors, disarming alarms, or opening garages. No public exploit identified at time of analysis, and the issue is patched in 2026.5.3 by unexporting LocationSensorManager and introducing a thin RequestAccurateLocationReceiver proxy that drops attacker-supplied extras.
Samsung Account versions prior to 15.7.01.1 on Samsung Android devices expose an improperly exported application component that any other app installed on the same device can query to read sensitive account data. Exploitation requires a malicious or compromised local app already present on the device - there is no remote access, no user interaction, and no elevated privilege requirement per the CVSS vector (PR:N/UI:N) - making this a medium-severity local information-disclosure issue (CVSS 4.0 base 6.9). No public exploit code has been identified at time of analysis.
ManabiPocket for Parents 1.2.3 and earlier — an Android companion app for a Japanese parental school-communication service published by NTT Docomo Business, Inc. — exposes at least one application component that is reachable by other apps on the same device. A malicious app the user has already installed can send a crafted Intent to that component and read sensitive data held by the parental app, making this a local information-disclosure issue rather than a remote compromise. Severity is low (CVSS 4.0 base 1.8) because exploitation requires local code execution, user interaction and additional attack requirements; no public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS data was not supplied.
Samsung Mobile Visual Voicemail for Android prior to version 20.1.00.05 improperly exports application components, allowing a co-installed malicious app on the same device to trigger outgoing calls without holding the required Android CALL_PHONE permission. The CVSS 4.0 score of 4.8 (AV:L/PR:L) accurately reflects the local-only, low-privilege attack surface. Samsung has released a patched build (20.1.00.05) in its September 2026 mobile security bulletin, and no public exploit code has been identified at time of analysis.
Improper export of Android application components in Samsung Bixby Touch prior to version 4.3.01.17 allows any co-installed application on the same device to access sensitive information without requiring special Android permissions. The vulnerability stems from one or more app components being declared exported in the application manifest without enforcing appropriate permission checks, giving locally present adversarial apps direct access to data the Bixby Touch service handles. Samsung Mobile has released a patched version (4.3.01.17) via its monthly security bulletin; no public exploit or active exploitation has been identified at time of analysis.
MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Ekia File Manager 1.2.7 for Android ships an exported ContentProvider (com.ekia.filecontrolmanager.OpenFileProvider) that declares no android:permission, readPermission, or writePermission, so any other app on the same device can invoke it. The provider maps the caller-supplied URI path straight to a filesystem path and passes it to new File(...), letting a malicious local app make the File Manager process read, create, overwrite, or delete every file that process can reach. The issue is not in CISA KEV, EPSS is only 0.11% (2nd percentile), and no public exploit tooling was identified in the supplied data, so real-world priority depends almost entirely on whether untrusted apps can be installed on the target device.
Improper export of Android application components in Lenovo File Manager (Chinese-market distribution) enables a locally authenticated user or co-installed application to read or modify files that the application designates as protected. The root cause is CWE-926, where one or more Android components - likely a content provider or activity - are exported without enforcing the application's own authorization logic. No public exploit code exists and the vulnerability has not been added to CISA KEV; however, the CVSS 4.0 score of 8.4 reflects genuine high-impact file access if an attacker can install a companion malicious application on the target device.
Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.
Location spoofing in the Home Assistant Android companion app prior to 2026.5.3 allows any co-installed application - even one with zero runtime permissions - to forge the device's reported GPS position by broadcasting a crafted Google Play Services LocationResult to an unprotected exported BroadcastReceiver. The forged coordinates are forwarded to the user's Home Assistant server as the device's real location, defeating Android's developer-mode Mock Location gate and enabling abuse of zone-based automations such as unlocking doors, disarming alarms, or opening garages. No public exploit identified at time of analysis, and the issue is patched in 2026.5.3 by unexporting LocationSensorManager and introducing a thin RequestAccurateLocationReceiver proxy that drops attacker-supplied extras.
Samsung Account versions prior to 15.7.01.1 on Samsung Android devices expose an improperly exported application component that any other app installed on the same device can query to read sensitive account data. Exploitation requires a malicious or compromised local app already present on the device - there is no remote access, no user interaction, and no elevated privilege requirement per the CVSS vector (PR:N/UI:N) - making this a medium-severity local information-disclosure issue (CVSS 4.0 base 6.9). No public exploit code has been identified at time of analysis.
ManabiPocket for Parents 1.2.3 and earlier — an Android companion app for a Japanese parental school-communication service published by NTT Docomo Business, Inc. — exposes at least one application component that is reachable by other apps on the same device. A malicious app the user has already installed can send a crafted Intent to that component and read sensitive data held by the parental app, making this a local information-disclosure issue rather than a remote compromise. Severity is low (CVSS 4.0 base 1.8) because exploitation requires local code execution, user interaction and additional attack requirements; no public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS data was not supplied.
Samsung Mobile Visual Voicemail for Android prior to version 20.1.00.05 improperly exports application components, allowing a co-installed malicious app on the same device to trigger outgoing calls without holding the required Android CALL_PHONE permission. The CVSS 4.0 score of 4.8 (AV:L/PR:L) accurately reflects the local-only, low-privilege attack surface. Samsung has released a patched build (20.1.00.05) in its September 2026 mobile security bulletin, and no public exploit code has been identified at time of analysis.
Improper export of Android application components in Samsung Bixby Touch prior to version 4.3.01.17 allows any co-installed application on the same device to access sensitive information without requiring special Android permissions. The vulnerability stems from one or more app components being declared exported in the application manifest without enforcing appropriate permission checks, giving locally present adversarial apps direct access to data the Bixby Touch service handles. Samsung Mobile has released a patched version (4.3.01.17) via its monthly security bulletin; no public exploit or active exploitation has been identified at time of analysis.
MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.