Monthly
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Information disclosure in Pure Storage FlashArray Purity (versions 6.5.0-6.5.8 and 6.10.0-6.10.5) allows an authenticated low-privileged user to retrieve sensitive data via insufficiently filtered data paths. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity, and availability impact, but SSVC indicates no public exploitation and the attack is not automatable. No public exploit has been identified at the time of analysis.
Arbitrary Android intent execution in mobile-mcp npm package (versions <0.0.50) allows remote attackers to trigger USSD codes, phone calls, SMS drafting, and content provider access through unvalidated URL schemes passed to adb shell commands. Attack vector exploits AI agent prompt injection: malicious documents can instruct connected AI systems to execute dangerous intents on paired Android devices. CVSS 8.3 (Network/Low complexity/No privileges/User interaction required). Publicly available exploit code exists. Vendor-released patch available (version 0.0.50+).
The ゲオアプリ (GEO app) from GEO CORPORATION fails to properly authorize requests handled through its registered custom URL scheme, so an attacker who can get a victim to open a crafted link can redirect the app's in-app browser (WebView) to an arbitrary website, exposing the user to phishing content or leaking a service session ID. The flaw affects both the Android and iOS builds (CWE-939; CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning the attack is remote and unauthenticated but depends on victim interaction, with impact limited to low confidentiality and integrity loss and no availability effect. This is a medium-severity issue, not a top-tier priority, and no public exploit was identified at time of analysis.
Improper handling of custom URL schemes in the Android application Ticket Ryutsu Center allows a malicious co-resident app on the same device to send a crafted Intent that causes the victim app to open an arbitrary website. Exploitation requires a separate attacker-controlled application to already be installed and depends on user interaction; impact is limited to low integrity violation with no code execution, data theft, or availability loss. No public exploit identified at time of analysis, and the issue is assessed as genuinely low priority.
Improper authorization in Myna Point's Android Intent handler allows a co-installed malicious application to invoke the app's custom URL scheme handler without caller validation, triggering arbitrary JavaScript execution within the app's WebView context. All versions of the Japanese government digital identity application (Digital Agency, CPE wildcard) appear affected per JVN advisory JVN67155805. No public exploit identified at time of analysis, though the attack surface is inherently local and requires a malicious app on the same device.
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list this as actively exploited, but the zero-privilege requirement from the attacker's side and the broad Samsung device install base make timely patching advisable.
SemClipboardService on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes an authorization bypass that allows a locally authenticated attacker to read clipboard contents without the expected permission check. The flaw is confined to Samsung's proprietary clipboard service and does not affect stock Android builds. No public exploit has been identified at time of analysis, and no active exploitation is listed in CISA KEV.
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Information disclosure in Pure Storage FlashArray Purity (versions 6.5.0-6.5.8 and 6.10.0-6.10.5) allows an authenticated low-privileged user to retrieve sensitive data via insufficiently filtered data paths. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity, and availability impact, but SSVC indicates no public exploitation and the attack is not automatable. No public exploit has been identified at the time of analysis.
Arbitrary Android intent execution in mobile-mcp npm package (versions <0.0.50) allows remote attackers to trigger USSD codes, phone calls, SMS drafting, and content provider access through unvalidated URL schemes passed to adb shell commands. Attack vector exploits AI agent prompt injection: malicious documents can instruct connected AI systems to execute dangerous intents on paired Android devices. CVSS 8.3 (Network/Low complexity/No privileges/User interaction required). Publicly available exploit code exists. Vendor-released patch available (version 0.0.50+).
The ゲオアプリ (GEO app) from GEO CORPORATION fails to properly authorize requests handled through its registered custom URL scheme, so an attacker who can get a victim to open a crafted link can redirect the app's in-app browser (WebView) to an arbitrary website, exposing the user to phishing content or leaking a service session ID. The flaw affects both the Android and iOS builds (CWE-939; CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning the attack is remote and unauthenticated but depends on victim interaction, with impact limited to low confidentiality and integrity loss and no availability effect. This is a medium-severity issue, not a top-tier priority, and no public exploit was identified at time of analysis.
Improper handling of custom URL schemes in the Android application Ticket Ryutsu Center allows a malicious co-resident app on the same device to send a crafted Intent that causes the victim app to open an arbitrary website. Exploitation requires a separate attacker-controlled application to already be installed and depends on user interaction; impact is limited to low integrity violation with no code execution, data theft, or availability loss. No public exploit identified at time of analysis, and the issue is assessed as genuinely low priority.
Improper authorization in Myna Point's Android Intent handler allows a co-installed malicious application to invoke the app's custom URL scheme handler without caller validation, triggering arbitrary JavaScript execution within the app's WebView context. All versions of the Japanese government digital identity application (Digital Agency, CPE wildcard) appear affected per JVN advisory JVN67155805. No public exploit identified at time of analysis, though the attack surface is inherently local and requires a malicious app on the same device.
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list this as actively exploited, but the zero-privilege requirement from the attacker's side and the broad Samsung device install base make timely patching advisable.
SemClipboardService on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes an authorization bypass that allows a locally authenticated attacker to read clipboard contents without the expected permission check. The flaw is confined to Samsung's proprietary clipboard service and does not affect stock Android builds. No public exploit has been identified at time of analysis, and no active exploitation is listed in CISA KEV.