CVE-2026-95180
Description
A flaw was found in agentweb-core. Due to improper access control in DefaultWebClient when handling intent URLs, a local attacker can launch non-exported host application components. An attacker can exploit this vulnerability to bypass access restrictions and obtain sensitive information.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires local access on the target device to craft malicious intent schemes, limiting the blast radius to unauthorized activation of internal components and localized data exposure. The affected AgentWeb library is designed specifically for Android mobile application development and is not included or supported across Red Hat enterprise software. Therefore, Red Hat products are not impacted by this issue.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context; Bypass Protection Mechanism
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
