Android App Myna Point
Monthly
Improper authorization in Myna Point's Android Intent handler allows a co-installed malicious application to invoke the app's custom URL scheme handler without caller validation, triggering arbitrary JavaScript execution within the app's WebView context. All versions of the Japanese government digital identity application (Digital Agency, CPE wildcard) appear affected per JVN advisory JVN67155805. No public exploit identified at time of analysis, though the attack surface is inherently local and requires a malicious app on the same device.
Improper authorization in Myna Point's Android Intent handler allows a co-installed malicious application to invoke the app's custom URL scheme handler without caller validation, triggering arbitrary JavaScript execution within the app's WebView context. All versions of the Japanese government digital identity application (Digital Agency, CPE wildcard) appear affected per JVN advisory JVN67155805. No public exploit identified at time of analysis, though the attack surface is inherently local and requires a malicious app on the same device.