CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

EUVD-2026-54570

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-47363

The CVE-2026-47363 describes a vulnerability in the Datadog Android app where the launcher activity AppActivity is exported with no permission guard and launchMode=singleTask. On every onCreate/onNewIntent, an extension (Intent.getUserSession()) deserializes a full UserSession (including user ide...

CVE-2026-44964

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

EUVD-2026-54567

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

multi-layered-security-assessment

Advanced Network Attack and Defense: Multi-Layered Assessment...

CVE-2025-15464

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464

The CVE-2025-15464 entry concerns yintibao Fun Print Mobile (Android, ARM64) with version 6.05.15 affected. The issue is an exported PandoraEntry activity that processes unvalidated external intents, enabling external applications to gain application context and directly launch Gmail with inbox a...

CVE-2025-15464 KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464 KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

PT-2026-1770

Name of the Vulnerable Software and Affected Versions Gmail affected versions not specified Description An exported activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls. This allows unauthorized access to Gmail...

yintibao Fun Print Mobile 安全漏洞

yintibao Fun Print Mobile is a mini-printer companion mobile application from China-based yintibao yintibao. A security vulnerability exists in yintibao Fun Print Mobile that stems from an exported Activity bypassing security controls, which could lead to Gmail inbox access...

CVE-2025-65820

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your...

EUVD-2025-202626

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your...

CVE-2025-65820

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your...