Setup App
Monthly
Revoking runtime permissions from other apps is possible on Motorola devices running Motorola Setup App versions before the 2026-01-01 fixed release, because an exported Setup App component lacks a guarding permission (CWE-862). A local, low-privilege malicious app already installed on the same device can trigger this without user interaction (CVSS 4.8, PR:L/UI:N); remote exploitation is not possible, and there is no data disclosure. No public exploit code identified at time of analysis, and the vendor has made a patch available.
Revoking runtime permissions from other apps is possible on Motorola devices running Motorola Setup App versions before the 2026-01-01 fixed release, because an exported Setup App component lacks a guarding permission (CWE-862). A local, low-privilege malicious app already installed on the same device can trigger this without user interaction (CVSS 4.8, PR:L/UI:N); remote exploitation is not possible, and there is no data disclosure. No public exploit code identified at time of analysis, and the vendor has made a patch available.