Secure Folder EUVD-2026-86481

Requires local presence on the same Android device: a second application or file manager that holds read access to the shared-storage path where Secure Folder 1.2 writes vaulted files. Exploitation is limited by needing that co-resident app/permission (PR:L, AV:L) and the presence of Android runtime/scoped-storage permissions; there is no remote or network vector, and only confidentiality is affected (files can be read/copied, not modified through this flaw). The core enabling condition is design behavior, not a special setting - the vault stores selected files unencrypted by default, so any deployment of version 1.2 that has files added to the vault is affected.

This is a low-to-moderate real-world risk despite the 6.8 CVSS 4.0 score. The vendor vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H) correctly frames this as a LOCAL confidentiality-only exposure: an attacker must already have code (a malicious/nosy app) or a file manager running on the same device with access to the shared-storage path - there is no network reach. There is no EPSS score, no CISA KEV listing, and no public exploit code provided, so the exploitation status is 'no public exploit identified at time of analysis.' The single high signal is technical impact (VC:H): the flaw fully defeats the app's core promise of a 'password-protected vault' because the underlying files are never encrypted. Countering that, the affected product is an obscure third-party Android app with a tiny footprint, and exploitation requires prior local presence, so this is a genuine-but-narrow issue rather than a mass-exploitation priority. Note the tags list 'Google' and 'Hashicorp' as vendors, which is inconsistent with the description - the app is an independent developer's product merely hosted on Google Play and has no HashiCorp relationship; treat those vendor associations as unreliable.

A user installs a seemingly benign app (or connects a file manager) that holds Android shared-storage read permission. Because Secure Folder 1.2 saves 'vaulted' files unencrypted in shared storage, that app silently enumerates and copies the supposedly protected documents/photos without ever prompting for the vault password. No public PoC is referenced, but the technique is trivial given local storage access.