Wikipedia Android App EUVD-2026-87344

Exploitation requires the Wikipedia Android App's SharedPreferenceCookieManager to attach stored CentralAuth session cookies to a request destined for an attacker-controlled domain. The specific prerequisite is the flawed authority matching: the pre-fix code used domain.endsWith(domainSpec) and did not require BOTH the request domain and the cookie's stored domain to be Wikimedia authorities, so a domain crafted to end with an approved suffix (e.g. a lookalike registered domain) matches. The attacker must induce the logged-in user's app to issue a request to that domain (UI:P - passive user interaction, such as following a crafted link). Limiting factors: the user must be authenticated (holding CentralAuth cookies), the attacker must control a domain that both is reachable by the app and defeats the suffix check, and user interaction is required - there is no fully automated, zero-click remote path.

The vendor-supplied CVSS is 4.0-only (5.3, medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:L - network reachable, low complexity, no privileges, but passive user interaction required and only limited confidentiality impact. There is no EPSS score, no CISA KEV listing, and no public exploit code, so this is not an urgent-priority item - it reads as a defense-in-depth cookie-scoping hardening fix rather than an actively exploited flaw. The signals are internally consistent: a medium CVSS driven down by UI:P and VC:L, with no exploitation-maturity evidence. One nuance the raw score understates: the leaked data is CentralAuth session/auth cookies, whose disclosure could enable account takeover, so real-world impact if exploited could exceed the 'VC:L' label - but this is gated behind the attacker persuading the app to contact a lookalike domain, which materially limits practicality. No SSVC decision data was provided in the input. Overall: low-to-medium real-world priority.

An attacker registers a lookalike domain whose name ends with an approved Wikimedia authority string (the pre-fix code used a loose domain.endsWith(domainSpec) match, so e.g. 'evilwikipedia.org' satisfies the 'wikipedia.org' suffix test) and lures a logged-in Wikipedia Android App user into having the app issue a request to it. Because of the flawed authority matching, the app attaches the user's stored CentralAuth session cookies to that outbound request, disclosing them to the attacker. No public proof-of-concept exploit is identified; exploitation requires user interaction (UI:P) and an attacker-controlled domain the app can be induced to contact.