Shortcutter 2 App EUVD-2026-104961

Exploitation requires LOCAL access to the Android device - specifically a second, attacker-controlled application installed on the same device as Shortcutter 2 App 9.0.48 (PR:L reflects the low privilege of an ordinary installed app, not system/root). The attacker leverages an improperly exported Android component that passes an attacker-influenced argument into Class.forName within ToggleGeneric.java. Limiting factors: there is no network/remote vector (AV:L), the attacker must first get a malicious app onto the device, and impact is bounded to Low with no privilege or scope escalation to other systems. Upgrading to version 9.0.90 remediates the issue.

This is a genuinely medium/low real-world risk, not a false-positive high-CVSS issue - in fact the signals are consistent and all point to limited severity. The CVSS 4.0 base vector (AV:L/AC:L/PR:L/UI:N) requires local access and at least low privileges, meaning an attacker already needs a foothold on the device (typically a malicious co-resident app), which substantially caps exploitability. Impact is uniformly Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L) with no subsequent-system impact (SC/SI/SA:N), fitting CWE-926 (improper export of Android components) where a sibling app can reach a component that should have been private. A public exploit exists (POC=YES) and the CVSS carries E:P (Proof-of-Concept exploit maturity), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The missing EPSS data is a gap, but given the local-only vector and niche product, low-volume real-world exploitation is the reasonable expectation. No signals are conflicting; the main uncertainty is the absence of EPSS/KEV data rather than any contradiction.

A user installs a malicious or compromised Android app alongside Shortcutter 2 (v9.0.48). Because ToggleGeneric.java uses Class.forName on an attacker-influenceable argument through an improperly exported component, the malicious app sends a crafted intent/IPC to invoke or instantiate an unintended class, leaking information or triggering unintended behavior. A public proof-of-concept for this attack has been disclosed.