CVE-2026-107058EUVD-2026-113256GHSA-2WCF-XFJ4-4XC8
An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
CISA SSVC
- Exploitation: poc
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Shelter, an Android app for managing work profiles and cloned apps, is affected by this vulnerability. An attacker could exploit it to take over another user's binder service, gaining control over that user's API access and preference settings.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
No affected packages have been listed by the sources.