Damn-Vulnerable-Android-Components

Уязвимые компоненты Android - DVAC Реинкарнация Sieve! Damn Vulnerable Android Components DVAC — это образовательное Android-приложение, намеренно созданное для выявления и демонстрации уязвимостей, связанных с различными компонентами Android, такими как Activity, Intent, Content Provider и...

CVE-2026-22010-Android-Intent-Redirection-to-Exported-Component

CVE-2026-22010 – 내보낸exported 컴포넌트로의 Android 인텐트 리디렉션 프로그램 코드 Java/Android 시뮬레이션 root@kitploit: // VulnActivity.java - Exported activity that forwards intents public class VulnActivity extends Activity @Override protected void onCreateBundle b super.onCreateb; Intent incoming = getIntent; //...

com.heytap.browser

취약점 보고서 개요: Android 플랫폼의 com.heytap.browser 애플리케이션에서 취약점이 발견되었습니다. 이 취약점으로 인해 공격자는 별도의 권한 없이 애플리케이션 컨텍스트 내에서 임의의 JavaScript 코드를 실행할 수 있습니다. 애플리케이션 세부 정보: 공급업체: - ColorOS 애플리케이션 이름: 'Internet Browser' com.heytap.browser 버전: 45.10.3.4.1 컴포넌트: com.android.browser.RealBrowserActivity 취약점 세부 정보: 취약점...

CVE-2020-23349_Lab

CVE-2020-23349 Android Lab Sina Weibo Android SDK 4.2.7のIntent Redirection脆弱性をローカルで再現する教育用プロジェクトです。 許可されたテスト端末またはエミュレータでのみ使用してください。実際のユーザーアプリを対象に使用してはいけません。 構成 victim: 実際のopenDefault-4.2.7.aarを含む脆弱なアプリ attacker: exported WbShareTransActivityを呼び出す攻撃アプリ victim/.../PrivateActivity:...

apk-interceptor

apk-interceptor Android 딥링크, Intent 및 WebView 브리지 평가 헬퍼 apk-interceptor는 승인된 애플리케이션 보안 평가를 위한 휴대용 Android 테스트 APK입니다. 보안 엔지니어가 Android 앱이 커스텀 URI 스킴, 딥링크, exported Activity 및 WebView JavaScript 브리지와 같은 외부 진입점을 어떻게 처리하는지 검증하는 데 도움을 줍니다. 이 도구는 의도적으로 제약되어 있습니다: android.permission.INTERNET을 선언하지 않습니다...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47363

The CVE-2026-47363 describes a vulnerability in the Datadog Android app where the launcher activity AppActivity is exported with no permission guard and launchMode=singleTask. On every onCreate/onNewIntent, an extension (Intent.getUserSession()) deserializes a full UserSession (including user ide...

EUVD-2026-54570

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-44964

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

EUVD-2026-54567

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

multi-layered-security-assessment

Advanced Network Attack and Defense: Multi-Layered Assessment...

CVE-2025-15464

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464

The CVE-2025-15464 entry concerns yintibao Fun Print Mobile (Android, ARM64) with version 6.05.15 affected. The issue is an exported PandoraEntry activity that processes unvalidated external intents, enabling external applications to gain application context and directly launch Gmail with inbox a...

CVE-2025-15464 KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464 KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...