Live › vulnerability › CVE-2026-113385
Go to dashboardShortcutter 2 version 9.0.48 for Android has an improper export of application components, reached through a Class.forName call in ToggleGeneric.java that takes an attacker-controlled class name. A local app on the same device can use it to reach components it should not, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Android users running Shortcutter 2 or earlier on a device where other apps or local processes can run. The sources describe local access as required, so exposure depends on whether untrusted apps share the device. Devices already on or later are not affected by this issue.
9.0.489.0.90No product ranges from the sources yet.
9.0.48 or earlier9.0.90 or later, per the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
This page as .md · .json · in your agent: get_signal("CVE-2026-113385")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.