Shortcutter 2 App
Monthly
Improperly exported Android components in LeeDrOiD Labs Shortcutter 2 App 9.0.48 let a second, attacker-controlled application installed on the same device drive the app's internal ToggleGeneric logic and pass an arbitrary class name into Class.forName, producing low-severity information disclosure plus limited integrity and availability impact confined to the device. The attack is strictly local - there is no network vector - and requires only the ordinary privileges of a co-installed app (CVSS PR:L), so the attacker must first convince the user to install a malicious package. Publicly available exploit code exists (VulDB disclosure with a linked proof-of-concept document), but there is no CISA KEV listing, and the vendor was contacted early and released a fixed build, 9.0.90.
Improperly exported Android components in LeeDrOiD Labs Shortcutter 2 App 9.0.48 let a second, attacker-controlled application installed on the same device drive the app's internal ToggleGeneric logic and pass an arbitrary class name into Class.forName, producing low-severity information disclosure plus limited integrity and availability impact confined to the device. The attack is strictly local - there is no network vector - and requires only the ordinary privileges of a co-installed app (CVSS PR:L), so the attacker must first convince the user to install a malicious package. Publicly available exploit code exists (VulDB disclosure with a linked proof-of-concept document), but there is no CISA KEV listing, and the vendor was contacted early and released a fixed build, 9.0.90.