CVE-2026-18604CWE-926

CVE-2026-18604

Medium · published August 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00145 · 3.4th percentile
Weakness
CWE-926 · Improper Export of Android Application Components
Published
2026-08-03T21:16Z
References (5)
https://github.com/actuator/com.gogii.textplus · [email protected]https://vuldb.com/cve/CVE-2026-18604 · [email protected]https://vuldb.com/submit/851700 · [email protected]https://vuldb.com/vuln/385527 · [email protected]https://vuldb.com/vuln/385527/cti · [email protected]
EPSS history
Timeline
  • 03 AUG 15:45Z
    textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components
    cvelistv5