xiaomi-cve-2024-45352

xiaomi-cve-2024-45352 Reporte técnico sobre vulnerabilidad crítica de Xiaomi Vulnerability Summary A vulnerability was discovered in Xiaomi's default browser com.android.browser on various MIUI devices. The app fails to properly validate intents passed via startActivity, allowing malicious apps t...

deep-C

Deep-C Deep-C is an Android Deep Link Exploitation Framework that automatically decompiles APKs, identifies exposed and insecure deep link entry points, validates exploitability using static analysis and optional AI verification , and generates executable adb Proof-of-Concepts PoCs. Deep-C is...

EUVD-2026-74647

Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...

CVE-2021-25374_Samsung-Account-Access

CVE-2021-25374 - Samsung Account Access Script This script can be used to gain access to a victim's Samsung Account if they have a specific version of Samsung Members installed on their Samsung Device, and if the victim's device is from the US or Korea region. How to use this script: 1. Host a we...

CVE-2026-22010-Android-Intent-Redirection-to-Exported-Component

CVE-2026-22010 – Android Intent Redirection to Exported Component Program Code Java/Android simulation root@kitploit: // VulnActivity.java - Exported activity that forwards intents public class VulnActivity extends Activity @Override protected void onCreateBundle b super.onCreateb; Intent incomin...

vulnhawk

Escáner de seguridad de código impulsado por IA que encuentra vulnerabilidades que Semgrep y CodeQL pasan por alto. Inicio rápido • Acción de GitHub • Comparación • Lenguajes • FAQ El problema Las herramientas SAST tradicionales se basan en coincidencia de patrones y reglas de AST. Son excelentes...

CVE-2014-8609-exploit

CVE-2014-8609-exploit Durante el estudio de la explotación de pending intent, creé mi aplicación PoC de CVE-2014-8609 Referencia: 1. https://seclists.org/fulldisclosure/2014/Nov/81 2. https://github.com/locisvv/Vulnerable-CVE-2014-8609...

CVE-2026-28663

CVE-2026-28663 is a BAL (Background Activity Launch) bypass in Android's LauncherAppsService.java, specifically in the buildIntentSenderForUser method. An attacker can launch an activity from the background, leading to local escalation of privilege without requiring additional execution privilege...

EUVD-2026-73972

In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-28626

CVE-2026-28626 affects Android , specifically the onCreate method in SetupPassthroughActivity.java . The vulnerability stems from Intent redirection , which can be leveraged to launch an arbitrary activity. This leads to a local escalation of privilege requiring no additional execution privileges...

CVE-2026-28613

CVE-2026-28613 is a local escalation of privilege vulnerability in Android, located in the initAppLinkTypeAndIntent function of ChannelImpl.java . The root cause is improper input validation , which allows the launch of an arbitrary intent . No additional execution privileges are required, but us...

EUVD-2026-73963

In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

EUVD-2026-73962

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28612

CVE-2026-28612 is a logic error in the resolveActivity method of ActivityStarter.java within the Android framework , enabling Intent Redirection attacks that can lead to local escalation of privilege without additional execution privileges or user interaction. It is classified as High severity in...

CVE-2026-28599

CVE-2026-28599 is an Intent Redirection Bypass in the addCreatorToken function of ActivityManagerService.java within the Android framework, caused by a logic error . It enables local privilege escalation with no additional execution privileges required and no user interaction needed. The vulnerab...

CVE-2026-86550

NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...

EUVD-2026-72670

NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...

CVE-2026-86550 UXSS vulnerability in ZTE browser products

NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...

CVE-2026-86550

NuBrowser , a ZTE browser product, contains a universal cross-site scripting (UXSS) vulnerability (CVE-2026-86550). The root cause is a missing protocol whitelist validation on the S.browser_fallback_url field of intent:// URIs, which allows an attacker to inject javascript: URLs via 302 redirect...

CVE-2023-31014_Lab

CVE-2023-31014 Implicit Intent Hijacking Lab An educational Android Lab created based on the public report of CVE-2023-31014 in NVIDIA GeForce NOW for Android. It does not include NVIDIA source code, actual Action strings, or real authentication credentials. Facts confirmed from the public report...