Text Message And Call App
Monthly
Improper export of the DialerActivity component in textPlus Text Message and Call App (Android, versions up to 8.3.5) allows any co-installed application on the same device to invoke the com.gogii.textplus dialer component without authorization. Classified under CWE-926, this flaw permits a locally-present malicious app to trigger dialer functionality, leading to limited information disclosure and unauthorized interaction with call-related features. No public KEV listing confirms active exploitation, but a proof-of-concept is publicly available on GitHub, lowering the technical barrier for abuse.
Improper export of the DialerActivity component in textPlus Text Message and Call App (Android, versions up to 8.3.5) allows any co-installed application on the same device to invoke the com.gogii.textplus dialer component without authorization. Classified under CWE-926, this flaw permits a locally-present malicious app to trigger dialer functionality, leading to limited information disclosure and unauthorized interaction with call-related features. No public KEV listing confirms active exploitation, but a proof-of-concept is publicly available on GitHub, lowering the technical barrier for abuse.