by Kastro
Paper/Archive/CVE-2026-107021

CVE-2026-107021

mitre — Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attac…

EPSS 0.2%public exploitCVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 5.9.059 × 201.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reff-droid.org/packages/org.liberty.android.fantastischmemorefgithub.com/helloworld1/AnyMemoexploitgithub.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107021.md