Damn-Vulnerable-Android-Components

可恶的易受攻击的安卓组件 - DVAC 筛子重生！ 可恶的易受攻击的安卓组件（DVAC）是一款教育性安卓应用，专门暴露和演示与各种安卓组件（如 Activity、Intent、Content Provider 和 Broadcast Receiver）相关的漏洞。它被设计成一个密码管理器应用，用于安全地管理和存储密码（笑）。 受 Sieve 应用程序开创性工作的启发（该应用专注于类似漏洞，但已过时且与新版本安卓不兼容），DVAC 旨在填补空白，为学习安卓安全提供现代、最新的平台。DVAC...

apk-interceptor

apk-interceptor Asistente de evaluación de Deeplinks, Intents y puentes WebView para Android apk-interceptor es un APK de prueba portátil para Android, destinado a evaluaciones de seguridad de aplicaciones autorizadas. Ayuda a los ingenieros de seguridad a verificar cómo una aplicación Android...

com.heytap.browser

Vulnerability Report Overview: A vulnerability has been discovered in the com.heytap.browser application on the Android platform. The vulnerability allows an attacker to execute arbitrary JavsScript code within the context of the application without any permissions. Application Details: Vendor: -...

CVE-2023-41898_Lab

CVE-2023-41898 Unvalidated Deep Link Lab Laboratorio educativo de reproducción reducida creado a partir del informe de vulnerabilidad pública GHSL-2023-142 de Home Assistant Companion for Android y de la estructura de código abierto de la versión vulnerable 2023.8.2. No se utilizan servidores,...

CVE-2020-23349_Lab

CVE-2020-23349 Android Lab An educational project that reproduces the Intent Redirection vulnerability in Sina Weibo Android SDK 4.2.7 locally. Use only on authorized test devices or emulators. Do not use it against real user apps. Structure victim: vulnerable app that includes the actual...

CVE-2026-22010-Android-Intent-Redirection-to-Exported-Component

CVE-2026-22010 – Redirección de Intent de Android a Componente Exportado Código del programa simulación Java/Android root@kitploit: // VulnActivity.java - Exported activity that forwards intents public class VulnActivity extends Activity @Override protected void onCreateBundle b super.onCreateb;...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47363

The CVE-2026-47363 describes a vulnerability in the Datadog Android app where the launcher activity AppActivity is exported with no permission guard and launchMode=singleTask. On every onCreate/onNewIntent, an extension (Intent.getUserSession()) deserializes a full UserSession (including user ide...

EUVD-2026-54570

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-44964

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

EUVD-2026-54567

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

multi-layered-security-assessment

Advanced Network Attack and Defense: Multi-Layered Assessment...

CVE-2025-15464

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464

The CVE-2025-15464 entry concerns yintibao Fun Print Mobile (Android, ARM64) with version 6.05.15 affected. The issue is an exported PandoraEntry activity that processes unvalidated external intents, enabling external applications to gain application context and directly launch Gmail with inbox a...

CVE-2025-15464 KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...