Cordova Plugin X Socialsharing
Monthly
Local denial of service in cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) 6.0.4 for Android: the plugin registers an exported broadcast receiver (nl.xservices.plugins.ShareChooserPendingIntent) that dereferences Intent.EXTRA_CHOSEN_COMPONENT without a null check, so any other app on the device can crash the host application by sending a crafted ACTION_SEND broadcast without that extra. The flaw requires no permissions and no user interaction, and is reachable only on affected Android builds, so the impact is limited to availability (repeated application-level crashes) rather than data loss or code execution. Exploit code and a public write-up exist, but there is no evidence of this being exploited in the wild beyond proof-of-concept demonstration, and no CISA KEV listing.
Local denial of service in cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) 6.0.4 for Android: the plugin registers an exported broadcast receiver (nl.xservices.plugins.ShareChooserPendingIntent) that dereferences Intent.EXTRA_CHOSEN_COMPONENT without a null check, so any other app on the device can crash the host application by sending a crafted ACTION_SEND broadcast without that extra. The flaw requires no permissions and no user interaction, and is reachable only on affected Android builds, so the impact is limited to availability (repeated application-level crashes) rather than data loss or code execution. Exploit code and a public write-up exist, but there is no evidence of this being exploited in the wild beyond proof-of-concept demonstration, and no CISA KEV listing.