Monthly
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application components, enabling a physical attacker to bypass the app lock protection layer entirely. The flaw grants access to confidentiality- and integrity-sensitive data within locked applications without satisfying the intended authentication challenge. No public exploit is identified at time of analysis; exploitation is constrained to physical device access, limiting but not eliminating real-world risk for lost or stolen device scenarios.
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows any locally-installed malicious application to invoke the exported component and delete files under Samsung Contacts' privilege without requiring any elevated permissions of its own. The vulnerability stems from an Android component export misconfiguration, granting third-party apps unintended access to privileged file operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of privilege requirements make this straightforward to exploit on affected devices.
Session injection in the Datadog Android app (versions prior to 5.9.2) allows any zero-permission co-installed application to hijack the victim's Datadog identity by delivering crafted OAuth tokens directly to an unguarded exported activity, which auto-logs the victim in under an attacker-controlled identity without backend token validation. The vulnerability stems from AppActivity being declared android:exported='true' with no permission guard, accepting and persisting arbitrary UserSession data deserialized from intent Bundle extras. SSVC assessment lists exploitation as none and no public exploit has been identified, but the zero-permission precondition dramatically lowers the attacker capability bar.
Notification dismissal in the Datadog Android application (versions prior to 5.9.2) can be triggered by any zero-permission co-installed application through the improperly exported BubbleChatActivity component (CWE-926), allowing silent cancellation of the hard-coded Bits AI chat notification (ID 9201) with no identity validation of the caller or their supplied conversation_id. The impact is limited to nuisance-level denial of that specific notification and potential facilitation of in-app phishing workflows, with chat content remaining server-authentication gated and inaccessible to the attacker. SSVC assessment confirms no known active exploitation, and no public exploit code has been identified at time of analysis.
Six exported Android App Widget configuration activities in the Datadog Android application (versions prior to 5.9.2) allow a co-installed zero-permission malicious app to brute-force sequential App Widget IDs and trigger automatic Datadog session login for the victim, exposing live operational data - dashboards, SLOs, on-call schedules, incident details - as a visual side-channel. Exploitation is constrained by three simultaneous preconditions and data exfiltration is limited to screen-visible disclosure only, with no programmatic return path. No public exploit has been identified at time of analysis; SSVC rates exploitation as none with partial technical impact.
Improper export of the DialerActivity component in textPlus Text Message and Call App (Android, versions up to 8.3.5) allows any co-installed application on the same device to invoke the com.gogii.textplus dialer component without authorization. Classified under CWE-926, this flaw permits a locally-present malicious app to trigger dialer functionality, leading to limited information disclosure and unauthorized interaction with call-related features. No public KEV listing confirms active exploitation, but a proof-of-concept is publicly available on GitHub, lowering the technical barrier for abuse.
Local information disclosure in the Telephony component across 42 MediaTek chipsets enables any unprivileged application on the device to extract sensitive telephony data without elevated permissions. The root cause is a missing Android permission check (CWE-926: Improper Export of Android Application Components), allowing improperly exported Telephony interfaces to be queried by any installed app. No active exploitation is confirmed - EPSS sits at 0.15% (5th percentile) and the vulnerability is absent from CISA KEV - but the breadth of affected chipsets spanning budget through flagship tiers gives this issue significant deployment reach. Patch ALPS11086431 is available per MediaTek's August 2026 security bulletin.
Internal file disclosure in Stoat for Android allows any process capable of local intent dispatch to exfiltrate the app's internal storage - including the local message database and cached authentication tokens - through an unvalidated URI passed to the exported ShareTargetActivity. The attacker triggers a single, deceptive share interaction in which the victim selects a destination channel while the Stoat composer conceals the true nature of the attachment, showing only 'attachment' with no filename. No public exploit code has been identified and this CVE is not listed in CISA KEV; the upstream fix is confirmed via commit 50d5f5143940809ebb5a61e5f507c956c33aa970, though a specific patched release version is not independently confirmed.
Improper export of Android application components in the ASUS Router App enables any co-installed third-party application on the same Android device to send a crafted Intent that forces the ASUS Router App to navigate to an attacker-specified URL. The flaw, classified as CWE-926, allows an attacker-controlled application to abuse the exposed component as an open redirect, potentially rendering phishing content or harvesting router management credentials within the app's trusted interface context. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
AppLock on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes improperly exported Android application components, enabling a physical attacker to bypass the app lock protection layer entirely. The flaw grants access to confidentiality- and integrity-sensitive data within locked applications without satisfying the intended authentication challenge. No public exploit is identified at time of analysis; exploitation is constrained to physical device access, limiting but not eliminating real-world risk for lost or stolen device scenarios.
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows any locally-installed malicious application to invoke the exported component and delete files under Samsung Contacts' privilege without requiring any elevated permissions of its own. The vulnerability stems from an Android component export misconfiguration, granting third-party apps unintended access to privileged file operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of privilege requirements make this straightforward to exploit on affected devices.
Session injection in the Datadog Android app (versions prior to 5.9.2) allows any zero-permission co-installed application to hijack the victim's Datadog identity by delivering crafted OAuth tokens directly to an unguarded exported activity, which auto-logs the victim in under an attacker-controlled identity without backend token validation. The vulnerability stems from AppActivity being declared android:exported='true' with no permission guard, accepting and persisting arbitrary UserSession data deserialized from intent Bundle extras. SSVC assessment lists exploitation as none and no public exploit has been identified, but the zero-permission precondition dramatically lowers the attacker capability bar.
Notification dismissal in the Datadog Android application (versions prior to 5.9.2) can be triggered by any zero-permission co-installed application through the improperly exported BubbleChatActivity component (CWE-926), allowing silent cancellation of the hard-coded Bits AI chat notification (ID 9201) with no identity validation of the caller or their supplied conversation_id. The impact is limited to nuisance-level denial of that specific notification and potential facilitation of in-app phishing workflows, with chat content remaining server-authentication gated and inaccessible to the attacker. SSVC assessment confirms no known active exploitation, and no public exploit code has been identified at time of analysis.
Six exported Android App Widget configuration activities in the Datadog Android application (versions prior to 5.9.2) allow a co-installed zero-permission malicious app to brute-force sequential App Widget IDs and trigger automatic Datadog session login for the victim, exposing live operational data - dashboards, SLOs, on-call schedules, incident details - as a visual side-channel. Exploitation is constrained by three simultaneous preconditions and data exfiltration is limited to screen-visible disclosure only, with no programmatic return path. No public exploit has been identified at time of analysis; SSVC rates exploitation as none with partial technical impact.
Improper export of the DialerActivity component in textPlus Text Message and Call App (Android, versions up to 8.3.5) allows any co-installed application on the same device to invoke the com.gogii.textplus dialer component without authorization. Classified under CWE-926, this flaw permits a locally-present malicious app to trigger dialer functionality, leading to limited information disclosure and unauthorized interaction with call-related features. No public KEV listing confirms active exploitation, but a proof-of-concept is publicly available on GitHub, lowering the technical barrier for abuse.
Local information disclosure in the Telephony component across 42 MediaTek chipsets enables any unprivileged application on the device to extract sensitive telephony data without elevated permissions. The root cause is a missing Android permission check (CWE-926: Improper Export of Android Application Components), allowing improperly exported Telephony interfaces to be queried by any installed app. No active exploitation is confirmed - EPSS sits at 0.15% (5th percentile) and the vulnerability is absent from CISA KEV - but the breadth of affected chipsets spanning budget through flagship tiers gives this issue significant deployment reach. Patch ALPS11086431 is available per MediaTek's August 2026 security bulletin.
Internal file disclosure in Stoat for Android allows any process capable of local intent dispatch to exfiltrate the app's internal storage - including the local message database and cached authentication tokens - through an unvalidated URI passed to the exported ShareTargetActivity. The attacker triggers a single, deceptive share interaction in which the victim selects a destination channel while the Stoat composer conceals the true nature of the attachment, showing only 'attachment' with no filename. No public exploit code has been identified and this CVE is not listed in CISA KEV; the upstream fix is confirmed via commit 50d5f5143940809ebb5a61e5f507c956c33aa970, though a specific patched release version is not independently confirmed.
Improper export of Android application components in the ASUS Router App enables any co-installed third-party application on the same Android device to send a crafted Intent that forces the ASUS Router App to navigate to an attacker-specified URL. The flaw, classified as CWE-926, allows an attacker-controlled application to abuse the exposed component as an open redirect, potentially rendering phishing content or harvesting router management credentials within the app's trusted interface context. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.