CVE-2026-115724

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

CVE-2026-115724 VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

EUVD-2026-108712

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

PT-2026-121836

Name of the Vulnerable Software and Affected Versions VLC for Android versions prior to 3.7.2 Description A confused-deputy file overwrite issue exists in the FileUtils.getUri function. The application trusts content URIs based solely on the com.fsck.k9.attachmentprovider or gmail-ls authority. A...

CVE-2020-25203

The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications. By calling the intent with the action set to android.intent.action.VIEW, any other application is able to load any website/web content into the application's context, which is shown a...