AgentWeb EUVD-2026-102130

Exploitable only when a host app embeds agentweb-core ≤5.1.6-androidx AND loads untrusted or attacker-influenced web content in the AgentWeb WebView. The malicious page must deliver an intent:// URL (INTENT_SCHEME) that DefaultWebClient parses with Intent.parseUri and launches under the host Activity's identity without sanitizing it - the pre-fix code did not strip explicit component targets, selectors, nested EXTRA_INTENT payloads, or FLAG_GRANT_READ/WRITE/PERSISTABLE_URI_PERMISSION flags - allowing the page to start the host app's own non-exported components or coerce the host into granting its ContentProvider URI permissions (intent redirection). LIMITING FACTORS: the app must actually render attacker-controlled content; the impact is confined to the host app's own component/provider surface and its granted URI permissions (not device-wide or other apps, which the OS exported-check still gates); and the host must expose sensitive non-exported components or providers for the leak to be meaningful.

This is a moderate-severity Android intent-redirection / improper-access-control flaw (CWE-284) in the AgentWeb WebView library, and the signals are mixed. The published CVSS is 5.5 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - confidentiality-only, scope unchanged, no availability or integrity impact. Exploitation status is 'no public exploit identified at time of analysis': there is no EPSS score, no CISA KEV listing, and no POC flag in the input (a third-party write-up at FFG0d/security-advisories documents the issue but is not weaponized exploit code). CONFLICT TO VERIFY: the published vector asserts AV:L and PR:L (local, authenticated), yet the described mechanism - malicious intent:// URLs handled by DefaultWebClient - is driven by web content rendered in the WebView, which is normally network-delivered and requires no device privileges (AV:N/PR:N). The 'local attacker' wording in the description and the AV:L/PR:L metrics should be reconciled with the vendor, because they materially change exposure. Even under the more pessimistic AV:N reading, real-world risk is bounded: impact is limited to the host app's own non-exported components and ContentProvider URI grants (not device-wide), it only matters for apps that both embed vulnerable AgentWeb and load untrusted web content, and a vendor fix exists (5.1.7-androidx, commit 9efb1519). Net: a legitimate issue worth patching for affected apps, but not a mass-exploitation priority - closer to a targeted mobile-app attack than a widespread internet-facing threat.

A host Android app embeds agentweb-core ≤5.1.6-androidx and loads attacker-influenced web content in its AgentWeb WebView; the malicious page serves an intent:// URL with an explicit component= (or URI-permission grant flags) that DefaultWebClient parses via Intent.parseUri and launches with the host app's identity, pulling up the host's own non-exported Activity or coercing it into granting ContentProvider URI permissions, thereby leaking internal data. No public exploit code was identified, though a third-party security advisory describing the flaw exists.