---
id: "CVE-2026-107041"
kind: "vulnerability"
aliases: ["CVE-2026-107041"]
title: "Island: exported activity lets attackers freeze an Android device"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "island", "oasis-feng", "other"]
not_affected_if: ["island-not-installed"]
published_at: "2026-10-29T16:17:49+00:00"
first_seen_at: "2026-10-29T16:25:55+00:00"
updated_at: "2026-10-29T16:32:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107041", "first_seen_at": "2026-10-29T16:25:55+00:00"}]
---

# Island: exported activity lets attackers freeze an Android device

The FeatureActionActivity component of Oasis Feng's Island app (versionCode 51801) has insecure permissions, so any app or unauthorized party can trigger it. An attacker can force the device to freeze, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Island app version for versionCode `51801` (unknown how to read it from the sources)
- Confirm whether the app is installed on the device at all

## Timeline

- 2026-10-29T16:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107041

## From the sources

Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_