Bulk Share EUVD-2026-113174

Requires a separate unauthorized or malicious application installed and running on the same Android device as Bulk Share : Location Sender v2.1.0 (versionCode 5); that app invokes the improperly exported component to reach arbitrary data and influence data flow. Limiting factors: the attacker must already have an app on the device (local co-residence, not remote network access), the vulnerable version must be installed, and exploitation is bounded to what the exported component exposes - there is no indication of user interaction being required and no authentication gate on the exported component.

Signals conflict sharply here. The input carries a CVSS 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N and a vuln.today 'act_now' decision label, which on their face argue for immediate priority. However, the mechanism (CWE-926, improper export of an Android application component on 'Bulk Share : Location Sender' v2.1.0) means exploitation is realistically performed by a malicious app co-resident on the same device invoking the exported component - not over a network - so the supplied AV:N appears overstated and local (AV:L) is the more faithful vector; verify with the advisory. No EPSS score is provided, the CVE is not in CISA KEV, and no confirmed proof-of-concept exploit code is listed (only an F-Droid listing, the project's GitHub repo, a community advisory, and the NVD entry). Crucially, the affected product is a niche open-source Android app distributed via F-Droid with a very small install base, so even a high CVSS and an 'act_now' label translate into limited real-world risk. Net assessment: this is a genuine design flaw worth fixing for its users, but it is a high-CVSS / low-real-world-exposure issue rather than a widespread emergency - the 'act_now' label looks driven by the raw CVSS rather than by exploitation evidence or deployment scale.

A user installs the legitimate Bulk Share : Location Sender app alongside a malicious application on the same Android device. The malicious app sends crafted intents to the victim app's improperly exported component, reading sensitive location/shared data and manipulating the data flow without the user's consent. No public exploit code is identified at time of analysis, and the attack requires local co-residence rather than remote delivery.