Is there a public PoC exploit available for EUVD-2026-52340?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52340. Prioritise patching immediately. EPSS: 0.1%.

textPlus App EUVD-2026-52340

Q: What is the CVSS score of EUVD-2026-52340?

EUVD-2026-52340 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-18604 LOW

Improper Export of Android Application Components (CWE-926)

2026-08-03 VulDB

GHSA-p4m6-fc2r-5pvm

Google Information Disclosure Text Message And Call App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local vector because exploitation requires a co-installed app; PR:L since any installed application can send the Intent; no scope change and limited impact across all three pillars.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 03, 2026 - 17:37 NVD

MEDIUM LOW

CVSS changed

Aug 03, 2026 - 17:37 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Aug 03, 2026 - 17:13 vuln.today

CVE Published

Aug 03, 2026 - 15:45 cve.org

MEDIUM 4.8

DescriptionCVE.org

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

AnalysisAI

Improper export of the DialerActivity component in textPlus Text Message and Call App (Android, versions up to 8.3.5) allows any co-installed application on the same device to invoke the com.gogii.textplus dialer component without authorization. Classified under CWE-926, this flaw permits a locally-present malicious app to trigger dialer functionality, leading to limited information disclosure and unauthorized interaction with call-related features. No public KEV listing confirms active exploitation, but a proof-of-concept is publicly available on GitHub, lowering the technical barrier for abuse.

Technical ContextAI

CWE-926 (Improper Export of Android Application Components) arises when Activities, Services, Broadcast Receivers, or Content Providers are declared exported - explicitly or by implicit manifest inheritance - without enforcing custom permissions or access controls. In Android's inter-process communication (IPC) model, any third-party app can send an Intent to an exported component unless android:exported='false' is set or a custom signature-level permission gates access. The vulnerable component is DialerActivity within the com.gogii.textplus package, meaning arbitrary installed apps can dispatch Intents directly to the dialer UI. The CPE cpe:2.3:a:textplus:text_message_and_call_app:*:*:*:*:*:*:*:* covers all versions through 8.3.5 on Android.

RemediationAI

No vendor-released patched version has been confirmed in the available data - users should check the Google Play Store for a textPlus update above version 8.3.5 and apply it immediately if available. As a primary compensating control, users and administrators should restrict installation of untrusted or unverified third-party applications on devices running textPlus, since exploitation strictly requires a co-installed malicious app; enforcing this via Mobile Device Management (MDM) app allowlisting eliminates the companion-app attack path with no functional trade-off for managed devices. Consumer users should disable sideloading (Unknown Sources) in Android settings. Full vulnerability and PoC details are available at https://vuldb.com/cve/CVE-2026-18604 and https://github.com/actuator/com.gogii.textplus.