EUVD-2026-66243Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector requires malicious app co-installation; PR:N because Android Intent dispatch needs no elevated permissions; UI:R because victim must interact with the device or app to trigger exploitation.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
AnalysisAI
Improper authorization in Myna Point's Android Intent handler allows a co-installed malicious application to invoke the app's custom URL scheme handler without caller validation, triggering arbitrary JavaScript execution within the app's WebView context. All versions of the Japanese government digital identity application (Digital Agency, CPE wildcard) appear affected per JVN advisory JVN67155805. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a malicious Android application to be installed on the same physical device as Myna Point. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L scores 5.3 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a malicious Android application - potentially disguised as a utility or game - and convinces a Myna Point user to install it via side-loading or a deceptive Play Store listing. Once co-installed, the malicious app sends a crafted Intent targeting Myna Point's exported URL scheme handler, injecting a JavaScript payload that executes within the Myna Point WebView context, potentially accessing session tokens, displayed government data, or manipulating the app's displayed content. |
| Remediation | Users should update Myna Point to the latest version available through the Google Play Store, as the Digital Agency is expected to have released a corrected version addressing the Intent handler authorization flaw - consult the JVN advisory at https://jvn.jp/en/jp/JVN67155805/ for the confirmed fixed version, which is not specified in currently available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today