Live › vulnerability › CVE-2026-107058
Shelter, an Android app for running a second copy of apps in a work profile, has a flaw in which an attacker can register their own auth_key. This lets them take over another user's binder service API and preference state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:26 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.
This page as .md · .json · in your agent: get_signal("CVE-2026-107058")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.