OMN-Go EUVD-2026-113166

Exploitation requires a second, attacker-controlled app installed on the same Android device as OMN-Go (versionCode 26080824); that app invokes an application component OMN-Go exports without an adequate permission guard (CWE-926), yielding access to and control over the app's data. Limiting factors: this is local app-to-app IPC, not network-reachable despite the NVD AV:N rating, so the attacker must first get an app onto the device; impact is confined to data confidentiality and integrity within the app's reach (no availability impact). No user interaction with OMN-Go is needed once the malicious app runs.

Signals conflict sharply here. The NVD CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H) and the vuln.today Decision label is act_now, yet EPSS is only 0.17% (6th percentile), the CVE is not in CISA KEV, and no confirmed public exploit code is cited. More importantly, the mechanism (CWE-926 Improper Export of Android Application Components, 'invoke an exported component') is an on-device IPC flaw exploited by a co-resident malicious app - this contradicts the published AV:N (network) rating, which should almost certainly be AV:L (local). Treating the NVD network vector as authoritative overstates reach: this is not remotely reachable over a network, it requires another app already on the device. Combined with the product being a niche open-source Android app (OMN-Go) with a tiny install base, real-world risk is low-to-moderate despite the 9.1 headline. The act_now label is driven by the high CVSS, not by exploitation evidence; prioritize patching for the few affected installs rather than treating it as a widespread emergency. Verify the attack vector with the advisory - CVSS says network but CWE-926 and the description imply local app-to-app access.

A user has OMN-Go (versionCode 26080824) installed alongside a malicious or low-privilege app. The malicious app sends a crafted intent to OMN-Go's improperly exported component, which lacks adequate permission guards, allowing it to read OMN-Go's data and manipulate its data flow without user interaction. No confirmed working public exploit code was found; a third-party F-Droid advisory documents the issue.