CVE-2026-107032EUVD-2026-113174GHSA-XGXW-5223-JMG9
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, l
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
CISA SSVC
- Exploitation: poc
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
The Bulk Share: Location Sender Android app is affected by insecure permissions that let unauthorized apps invoke one of its exported components. An attacker could use this to access arbitrary data and control how data flows within the app.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
No affected packages have been listed by the sources.