Common Weakness Enumeration

CWE-926

Allowed

Improper Export of Android Application Components

Abstraction: Variant · Status: Incomplete

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

162 vulnerabilities reference this CWE, most recent first.

GHSA-JXGF-P72G-V48G

Vulnerability from github – Published: 2025-12-11 15:30 – Updated: 2026-04-29 04:13
VLAI
Details

A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity  of the file AndroidManifest.xml. Executing manipulation can lead to improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-14517"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-11T14:16:20Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity\u00a0 of the file AndroidManifest.xml. Executing manipulation can lead to improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-jxgf-p72g-v48g",
  "modified": "2026-04-29T04:13:36Z",
  "published": "2025-12-11T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14517"
    },
    {
      "type": "WEB",
      "url": "https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446#469832583e0444dcb3d08b0ca661d1c6"
    },
    {
      "type": "WEB",
      "url": "https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446?source=copy_link"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.335855"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.335855"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.702811"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-M427-85JP-939V

Vulnerability from github – Published: 2025-08-18 00:30 – Updated: 2025-08-18 00:30
VLAI
Details

A security vulnerability has been detected in BuzzFeed App 2024.9 on Android. This affects an unknown part of the file AndroidManifest.xml of the component com.buzzfeed.android. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-9093"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-17T22:15:25Z",
    "severity": "MODERATE"
  },
  "details": "A security vulnerability has been detected in BuzzFeed App 2024.9 on Android. This affects an unknown part of the file AndroidManifest.xml of the component com.buzzfeed.android. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-m427-85jp-939v",
  "modified": "2025-08-18T00:30:30Z",
  "published": "2025-08-18T00:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9093"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KMov-g/androidapps/blob/main/com.buzzfeed.android.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KMov-g/androidapps/blob/main/com.buzzfeed.android.md#steps-to-reproduce"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.320415"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.320415"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.623584"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-M5WR-8MCJ-V838

Vulnerability from github – Published: 2024-03-05 00:31 – Updated: 2024-03-05 00:31
VLAI
Details

An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-41827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-04T22:15:46Z",
    "severity": "MODERATE"
  },
  "details": "An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI.",
  "id": "GHSA-m5wr-8mcj-v838",
  "modified": "2024-03-05T00:31:14Z",
  "published": "2024-03-05T00:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41827"
    },
    {
      "type": "WEB",
      "url": "https://en-us.support.motorola.com/app/answers/detail/a_id/178273"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MVF8-P3F9-3X6G

Vulnerability from github – Published: 2025-09-19 15:31 – Updated: 2025-09-19 15:31
VLAI
Details

A vulnerability has been found in intsig CamScanner App 6.91.1.5.250711 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.intsig.camscanner. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-10717"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-19T15:15:48Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in intsig CamScanner App 6.91.1.5.250711 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.intsig.camscanner. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-mvf8-p3f9-3x6g",
  "modified": "2025-09-19T15:31:09Z",
  "published": "2025-09-19T15:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10717"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KMov-g/androidapps/blob/main/com.intsig.camscanner.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KMov-g/androidapps/blob/main/com.intsig.camscanner.md#steps-to-reproduce"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.325008"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.325008"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.645010"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MVXC-WC9G-RG5V

Vulnerability from github – Published: 2025-09-19 15:31 – Updated: 2025-09-19 15:31
VLAI
Details

A flaw has been found in Creality Cloud App up to 6.1.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.cxsw.sdprinter. Executing manipulation can lead to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-10716"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-19T15:15:46Z",
    "severity": "MODERATE"
  },
  "details": "A flaw has been found in Creality Cloud App up to 6.1.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.cxsw.sdprinter. Executing manipulation can lead to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-mvxc-wc9g-rg5v",
  "modified": "2025-09-19T15:31:09Z",
  "published": "2025-09-19T15:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10716"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KMov-g/androidapps/blob/main/com.cxsw.sdprinter.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.325007"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.325007"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.645009"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-P4M6-FC2R-5PVM

Vulnerability from github – Published: 2026-08-03 18:30 – Updated: 2026-08-03 18:30
VLAI
Details

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-18604"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-03T17:16:35Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.",
  "id": "GHSA-p4m6-fc2r-5pvm",
  "modified": "2026-08-03T18:30:47Z",
  "published": "2026-08-03T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18604"
    },
    {
      "type": "WEB",
      "url": "https://github.com/actuator/com.gogii.textplus"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-18604"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/851700"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/385527"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/385527/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-P54X-GRMR-9GW6

Vulnerability from github – Published: 2024-05-03 15:30 – Updated: 2024-05-03 15:30
VLAI
Details

A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information. 

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2023-41821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T14:15:09Z",
    "severity": "MODERATE"
  },
  "details": "\nA an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information.\u00a0\n\n",
  "id": "GHSA-p54x-grmr-9gw6",
  "modified": "2024-05-03T15:30:52Z",
  "published": "2024-05-03T15:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41821"
    },
    {
      "type": "WEB",
      "url": "https://en-us.support.motorola.com/app/answers/detail/a_id/178879"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P6MF-3J29-C4MM

Vulnerability from github – Published: 2025-07-21 21:31 – Updated: 2025-07-21 21:31
VLAI
Details

A vulnerability was found in Genshin Albedo Cat House App 1.0.2 on Android. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.house.auscat. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-7940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-21T21:15:27Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in Genshin Albedo Cat House App 1.0.2 on Android. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.house.auscat. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-p6mf-3j29-c4mm",
  "modified": "2025-07-21T21:31:42Z",
  "published": "2025-07-21T21:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7940"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KMov-g/androidapps/blob/main/com.house.auscat.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/KMov-g/androidapps/blob/main/com.house.auscat.md#video-proof-of-concept"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.317077"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.317077"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.619036"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-P6PW-XX6V-J4HH

Vulnerability from github – Published: 2026-08-07 18:31 – Updated: 2026-08-08 03:31
VLAI
Details

Six Android App Widget configuration activities in the Datadog Android application are declared android:exported="true" with no permission guard: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity. All six extend a shared base WidgetActivity that reads AppWidgetManager.EXTRA_APPWIDGET_ID from Intent extras and, when no resolved deep-link destination is supplied, uses that caller-controlled widget ID to look up the stored widget definition, fetch the associated user session, and perform an automatic login with source UserSessionSourceLogin.Automatic. Android App Widget IDs are small sequential integers assigned by AppWidgetManager. A zero-permission co-installed application can brute-force them by launching any of the six configuration activities with EXTRA_APPWIDGET_ID set to 1..N until one matches a configured widget on the victim device. When a match occurs, the activity foregrounds with the victim's session already loaded and renders the widget configuration UI, which is backed by live data pickers (SLOs, dashboards, incident severities and types, on-call pages and shifts) fetched through the victim's authenticated HTTP client. Exfiltration is screen-visible only — programmatic return of data to the caller is not possible from these activities. Disclosure is therefore a visual side-channel: accessibility services, screen recording, or screenshot capture. Preconditions: a malicious co-installed application, at least one of the six widgets configured on the victim's home screen, and an active Datadog session cached locally.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-44965"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-07T18:17:14Z",
    "severity": "MODERATE"
  },
  "details": "Six Android App Widget configuration activities in the Datadog Android application are declared android:exported=\"true\" with no permission guard: IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity. All six extend a shared base WidgetActivity that reads AppWidgetManager.EXTRA_APPWIDGET_ID from Intent extras and, when no resolved deep-link destination is supplied, uses that caller-controlled widget ID to look up the stored widget definition, fetch the associated user session, and perform an automatic login with source UserSessionSourceLogin.Automatic.\nAndroid App Widget IDs are small sequential integers assigned by AppWidgetManager. A zero-permission co-installed application can brute-force them by launching any of the six configuration activities with EXTRA_APPWIDGET_ID set to 1..N until one matches a configured widget on the victim device. When a match occurs, the activity foregrounds with the victim\u0027s session already loaded and renders the widget configuration UI, which is backed by live data pickers (SLOs, dashboards, incident severities and types, on-call pages and shifts) fetched through the victim\u0027s authenticated HTTP client.\nExfiltration is screen-visible only \u2014 programmatic return of data to the caller is not possible from these activities. Disclosure is therefore a visual side-channel: accessibility services, screen recording, or screenshot capture. \nPreconditions: a malicious co-installed application, at least one of the six widgets configured on the victim\u0027s home screen, and an active Datadog session cached locally.",
  "id": "GHSA-p6pw-xx6v-j4hh",
  "modified": "2026-08-08T03:31:12Z",
  "published": "2026-08-07T18:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44965"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/926.html"
    },
    {
      "type": "WEB",
      "url": "https://developer.android.com/develop/ui/views/appwidgets/configuration"
    },
    {
      "type": "WEB",
      "url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PGP3-V5MX-QQ76

Vulnerability from github – Published: 2026-08-10 09:31 – Updated: 2026-08-19 03:31
VLAI
Details

Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-21059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T08:16:47Z",
    "severity": "MODERATE"
  },
  "details": "Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts\u0027 privilege.",
  "id": "GHSA-pgp3-v5mx-qq76",
  "modified": "2026-08-19T03:31:18Z",
  "published": "2026-08-10T09:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21059"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2026\u0026month=08"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Mitigation
Build and Compilation

Strategy: Attack Surface Reduction

If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.

Mitigation
Build and Compilation

Strategy: Attack Surface Reduction

If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.

Mitigation
Build and Compilation Architecture and Design

Strategy: Attack Surface Reduction

Limit Content Provider permissions (read/write) as appropriate.

Mitigation
Build and Compilation Architecture and Design

Strategy: Separation of Privilege

Limit Content Provider permissions (read/write) as appropriate.

No CAPEC attack patterns related to this CWE.