GEO app EUVD-2026-101935

Exploitation requires the ゲオアプリ (GEO app) to be installed on the victim's Android or iOS device and requires the victim to interact with an attacker-supplied link that invokes the app's registered custom URL scheme (UI:R). The specific flaw is that the handler for that custom URL scheme performs improper authorization, allowing the in-app browser (WebView) to be pointed at an arbitrary, attacker-chosen URL rather than being restricted to trusted destinations. Limiting factors: the attack is not fully automatable because it depends on victim interaction (clicking/opening the crafted link), the impact is confined to confidentiality and integrity of the in-app session (Low/Low) with no availability effect, and the attacker must first deliver the malicious link to a user who has the app installed.

This is a medium-severity (CVSS 5.4) issue, not a top-tier priority. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) shows a network-reachable, low-complexity, unauthenticated flaw, but exploitation is gated by required user interaction (UI:R) and yields only Low confidentiality and Low integrity impact with no availability impact. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so all three exploitation-likelihood signals are either absent or negative, which is consistent with the modest CVSS base score. The practical risk is real but bounded: an attacker cannot act fully automatically because a victim must be lured into triggering the malicious custom URL scheme, and the payoff (redirecting the in-app browser to arbitrary sites for phishing or session-ID theft) is opportunistic rather than a direct system compromise. Note this advisory uses the CVSS 3.0 framework (not 3.1), and no SSVC decision data was supplied; treat exploitation-automation and technical-impact framing as inferred from the CVSS vector rather than confirmed by a vendor SSVC assessment.

An attacker crafts a malicious web page or message containing a link that invokes the ゲオアプリ custom URL scheme. When a victim with the app installed taps the link, the app's in-app browser is redirected to an attacker-controlled website that mimics a legitimate login or captures the service's session ID. No public exploit code is identified at time of analysis, and success depends on the victim interacting with the attacker-supplied link.