{"id":"CVE-2026-107020","kind":"vulnerability","aliases":["CVE-2026-107020"],"related":[],"title":"FeedEx Android news reader lets attackers force crafted URL fetches","description":"An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL.","summary":"FeedEx (Handy News Reader) versionCode 116 has an issue in its LoadLinkLaterActivity component on Android. An attacker can make a victim's app fetch a URL the attacker chose.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","feedex","handy-news-reader","package"],"not_affected_if":["other-app-versions"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:27:12+00:00","updated_at":"2026-10-29T15:27:12+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T15:27:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FeedEx Android news reader lets attackers force crafted URL fetches","impact":"low","summary":"FeedEx (Handy News Reader) versionCode 116 has an issue in its LoadLinkLaterActivity component on Android. An attacker can make a victim's app fetch a URL the attacker chose.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","feedex","handy-news-reader"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"victim app fetches an attacker-chosen URL, leaking limited data","analyst_note":"Check the NVD entry and the FeedEx project for the exact trigger, the fixed versionCode and whether the component is exported.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-app-versions"],"who_is_affected":"Users of the FeedEx / Handy News Reader Android app at versionCode 116, where the LoadLinkLaterActivity component can be reached by another app or link. The sources do not say which other conditions are required. Teams that do not ship or use this app can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000635,"input_tokens":4088,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107020':13A,16A '-2026':12A,15A '116':29B,65C 'activity.loadlinklateractivity':57C 'allow':66C 'android':2A,17B,38B 'app':46B 'attack':6A,40B,51B,67C 'chose':52B 'compon':36B,58C 'craft':8A,75C 'cve':11A,14A 'feedex':1A,18B,24B,60C 'fetch':10A,47B,73C 'forc':7A,69C 'handi':20B,25B,61C 'handy-news-read':19B 'issu':32B,54C 'let':5A 'loadlinklateract':35B 'make':42B 'news':3A,21B,26B,62C 'packag':23B 'reader':4A,22B,27B,63C 'url':9A,49B,76C 'user':71C 'versioncod':28B,64C 'victim':44B,70C","nicknames":[],"mitigations":[],"who_affected":"Users of the FeedEx / Handy News Reader Android app at versionCode 116, where the LoadLinkLaterActivity component can be reached by another app or link. The sources do not say which other conditions are required. Teams that do not ship or use this app can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T15:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107020","severity":null,"published_at":"2026-10-29T15:17:15+00:00","modified_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}