Forkyz EUVD-2026-113264

Requires the victim to be running Forkyz versionCode 8500000 and for a crafted URI string to be processed by the app's URI handler, which fails to properly authorize the request (CWE-863), allowing another user's storage settings to be changed. Limiting factors: impact is confined to storage-settings integrity with no confidentiality or availability loss; the attacker must get the crafted URI delivered to and handled by the target app, and for an Android app this typically implies either a co-installed malicious app sending an intent or the victim opening a deep link - the exact trigger and whether user interaction is needed are not described in the available sources, which conflicts with the published UI:N/AV:N metrics.

Signals conflict sharply. The published CVSS of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) is driven entirely by a High integrity impact over a network vector with no privileges or user interaction, which would normally mark this as a priority. However, the countervailing signals are strong: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit was identified. The vuln.today decision label is 'this_week' rather than act_now/emergency. There is also an internal inconsistency worth flagging: Forkyz is an Android crossword application (F-Droid / Codeberg), and the flaw is triggered by 'supplying a crafted URI string' - a delivery pattern (deep link or inter-app intent) that typically requires either local app presence or victim interaction, which is at odds with the AV:N/UI:N metrics; verify the true attack vector with the advisory. The actual impact ('change another user's storage settings') is a configuration-integrity issue with no confidentiality or availability loss, which appears narrower than the I:H rating suggests. Net: despite the 7.5 score, real-world risk is modest - a niche product, very low exploitation probability, no KEV, no exploit code, and limited impact. Treat as a routine patch item, not an emergency.

An attacker crafts a malicious URI and delivers it to a Forkyz user (versionCode 8500000), e.g. via a link or a co-installed Android app issuing an intent. Because the app performs incorrect authorization (CWE-863) when handling the URI, processing it alters the victim's storage settings without consent. No public exploit code was identified at the time of analysis, and the exact delivery/trigger mechanism is not described in the available sources.