EUVD-2026-113175
GHSA-xp3g-6854-g7cf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run co-resident malicious app
-
ExploitSend intent to unprotected exported component
-
ImpactTamper with stored shopping-list data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a second app (or ADB/shell access) already present on the same Android device that can send an intent to the exported component of Shopping List v11.0 (versionCode 11); the component enforces no caller permission or authentication, which is the flaw itself. Impact is scoped to manipulation of this app's shopping-list data. Limiting factors: the attacker must already have code running on the victim device (no purely remote network path), only this specific app version is implicated, and the affected product has an extremely small user base, so realistic exposure is narrow. |
| Impact | Signals conflict sharply. The supplied CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H), and the vuln.today Decision label is act_now with SSVC rating the flaw Automatable:yes and Technical Impact:total - which on paper reads as urgent. However, the mechanism is an insecure/exported Android component in an F-Droid shopping-list app (references point to F-Droid and the android-shoppinglist GitHub repo). Exported Android components are reached by other apps already present on the device via on-device IPC/intents, which is a local attack surface, so the input's AV:N is questionable - the network vector should be verified, as this looks like on-device exploitation rather than true remote access. Counter-signals also weigh against emergency treatment: EPSS is only 0.17% (6th percentile), the CVE is NOT in CISA KEV, and the product is an obscure open-source app with a tiny footprint. SSVC Exploitation is 'poc' (proof-of-concept), not active exploitation. Net: honor the act_now decision label for affected installs, but the real-world blast radius is constrained by the product's negligible deployment and the need for an attacker-controlled app to already be on the device. This is better characterized as a high-nominal-CVSS, low-realistic-risk issue for most environments. |
| Exploit ScenarioDerived | A malicious or co-resident app installed on the same Android device sends an intent to Shopping List v11.0's exported component, which performs no permission or caller checks, allowing the attacker app to tamper with the user's stored shopping-list data. A public PoC reference exists (the F-Droid advisory), but it is not verified as working exploit code. Given AC:L, no special timing or user interaction is needed once a hostile app is present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
wbpxre150 Shopping List v11.0 (versionCode 11) exposes an exported Android component that performs no caller permission or authentication check, so any other app already installed on the same device - or an ADB/shell session - can send it an intent and alter the user's shopping-list data. The published CVSS of 9.1 reflects a network-reachable view of the flaw, but the assessed vector (AV:L/AC:L/PR:N/UI:N/C:L/I:H/A:N) confirms there is no purely remote network path: the attacker must already have code executing on the victim handset, and impact is confined to this app's list data with no confidentiality or availability effect established. A public PoC reference exists (SSVC exploitation: poc) but is not verified as working exploit code; EPSS is low at 0.17% (6th percentile), yet the vuln.today decision label is act_now given total technical impact and full automatability, with exposure further limited by the app's very small user base.
RemediationAI
The supplied sources list no fixed version for this issue, so no vendor-released patch can be cited: the FFG0d F-Droid advisory (https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107028.md), the F-Droid package page (https://f-droid.org/packages/com.wbpxre150.shoppinglist/) and the upstream repository (https://github.com/wbpxre150/android-shoppinglist) should be checked for a build published after versionCode 11, and any such build should be installed in preference to v11.0. Because the exported component itself is the flaw, the only complete fix is a release that removes the export or enforces a caller permission; until one is confirmed, the practical compensating control is to remove Shopping List v11.0 from devices where untrusted or sideloaded applications are present, or to keep the device free of untrusted apps entirely, since the assessed exploitation condition requires a second app (or ADB/shell access) already running on the handset - the trade-off being loss of the app's functionality with no partial in-app workaround identified in the available sources. Blocking network ports or adding perimeter filtering provides no protection here, because the attack path is device-local intent invocation rather than remote network access.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an Android inter-process communication access-control weakness (CWE-284, improper access control) rather than a memory-safety or cryptographic defect. Android apps declare components (activities, services, broadcast receivers, content providers) that can be reachable by other applications via Intent objects; when such a component is exported and does not enforce a caller-facing permission or otherwise authenticate the caller, any co-resident application can invoke it with attacker-chosen data. Here the exported component in Shopping List v11.0 (package com.wbpxre150.shoppinglist, distributed through F-Droid and built from the wbpxre150/android-shoppinglist repository) is the shopping-list handler itself, so the missing caller check is simultaneously the vulnerability and the exploitation prerequisite - no bypass of a separate control is needed. The vulnerable surface is therefore the device-local app ecosystem, not an HTTP endpoint, which is why the assessed vector is AV:L despite the NVD-published AV:N rating. Only versionCode 11 is implicated in the available sources; no fixed build is listed in the supplied data.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Reached by a co-resident app via on-device IPC so AV:L not AV:N; no permission check gives PR:N/AC:L; impact is data manipulation (I:H) with limited read exposure (C:L) and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.
Executive ViewAI
CVE-2026-107028 is a critical vulnerability in the wbpxre150 Shopping List Android app that allows a malicious app on the same device to tamper with user shopping-list data without permission checks. Although the app has a very small user base, the flaw could enable integrity attacks for those users, harming trust and requiring remediation if the app is used in your organization.
No vendor patch is available. Enforce app uninstallation via MDM, restrict installation to trusted apps, and run on-device threat detection to flag malicious apps that may send intents to exported components.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB