EUVD-2026-40011
GHSA-579g-w2m6-c36g
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access required (AV:P) with no privileges or user interaction needed; only limited confidentiality impact from backup data exposure, no integrity or availability effect.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher.
AnalysisAI
Chess Play and Learn (chess.com) Android app versions up to 4.9.42 expose application backup files to unauthorized parties through a misconfiguration in AndroidManifest.xml that enables Android's backup mechanism without adequate authorization controls. Physical access to the target device is required to exploit this issue. A public proof-of-concept is available, exploitation probability is very low given the physical access requirement, and the vendor has acknowledged the issue while noting it falls outside their bug bounty scope.
Technical ContextAI
The vulnerability stems from the AndroidManifest.xml configuration of the com.chess Android application package (CPE: cpe:2.3:a:chess:chess_play_and_learn:*:*:*:*:*:android:*:*). The Android platform provides a backup API (ADB backup) controlled by the android:allowBackup attribute in the manifest. When set to true or left unguarded, it permits extraction of the application's private data directory contents via USB using the adb backup command - requiring no root access on the device but requiring physical USB connectivity. CWE-285 (Improper Authorization) is the root cause: the application fails to restrict which actors may trigger a data backup, allowing any person with physical device access to extract potentially sensitive app data (credentials, session tokens, game history, personal information stored by the app).
RemediationAI
The primary fix is to upgrade to a version of Chess Play and Learn beyond 4.9.42 once the vendor releases a patched build addressing the AndroidManifest.xml backup configuration. The vendor has confirmed awareness and intent to remediate. Users on unpatched versions should disable USB debugging on their Android device (Settings > Developer Options > USB Debugging) to eliminate the ADB backup attack surface - disabling developer options entirely is the most effective compensating control with no functional side effects for standard users. Additionally, enabling full-disk encryption and a strong lock screen PIN reduces the value of any backup data extracted if a device is physically compromised. Organizations managing Android fleets via MDM can enforce backup restrictions through Android Enterprise policies. No vendor advisory URL with an exact patch version is available at time of analysis; monitor the VulDB entry at https://vuldb.com/vuln/374522 for patch release confirmation.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today