Yamap Social Trekking Gps App
Monthly
The YAMAP - Social Trekking GPS App for Android exposes users to information leakage and unauthorized redirects through an improperly controlled WebView (in-app browser) implementation. The vulnerability stems from insufficient access control over which URLs or communication sources the WebView will process, allowing a crafted link or external input to steer the browser toward attacker-controlled content or harvest app-internal data. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis, but user interaction is required, making social engineering the realistic attack vector.
The YAMAP - Social Trekking GPS App for Android exposes users to information leakage and unauthorized redirects through an improperly controlled WebView (in-app browser) implementation. The vulnerability stems from insufficient access control over which URLs or communication sources the WebView will process, allowing a crafted link or external input to steer the browser toward attacker-controlled content or harvest app-internal data. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis, but user interaction is required, making social engineering the realistic attack vector.