Live › vulnerability › CVE-2026-107049
Forkyz, an Android crossword app, has a flaw where a crafted URI string can change another user's storage settings. An attacker can alter where the app stores data for a victim who opens the crafted link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:26 UTC. All times on this page are UTC.
The sources do not say which Forkyz versions beyond versionCode 8500000 are affected or whether a fixed release exists. Only people running that Android build of Forkyz are in scope; teams without the app can skip it.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.
This page as .md · .json · in your agent: get_signal("CVE-2026-107049")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.