PT-2026-87016

NuBrowser lacks protocol whitelist validation for the S.browser fallback url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websit...

CVE-2026-28599: Protection Mechanism Failure

In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28612: Protection Mechanism Failure

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-88214

In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-28626: URL Redirection to Untrusted Site

In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

ASB-A-329233015

In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

ASB-A-332883816

In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

ASB-A-487147249

In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-403565650

In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-475542441

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-397216638

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-66243

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

Android App "Myna Point" vulnerable to improper access restriction

Overview Android App "Myna Point" provided by Digital Agency contains the following vulnerability. Improper Authorization in Handler for Custom URL Scheme CWE-939 - CVE-2026-73335 RyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and IPA. JPCERT/CC coordinated with th...

CVE-2026-73335

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

CVE-2026-73335

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

CVE-2026-73335: Improper Authorization in Handler for Custom URL Scheme

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

PT-2026-81931

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

CVE-2026-78196

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument displayname results in path traversal. The attack requires a loc...

CVE-2026-78196 achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument displayname results in path traversal. The attack requires a loc...

CVE-2026-78196 achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument displayname results in path traversal. The attack requires a loc...