{"id":"CVE-2026-113385","kind":"vulnerability","aliases":["CVE-2026-113385"],"related":[],"title":"Shortcutter 2 Android app: component export flaw lets local apps reach internals","description":"A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","summary":"Shortcutter 2 version 9.0.48 for Android has an improper export of application components, reached through a Class.forName call in ToggleGeneric.java that takes an attacker-controlled class name. A local app on the same device can use it to reach components it should not, and a public exploit has been disclosed.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile","package","shortcutter-2"],"not_affected_if":["no-untrusted-local-apps","updated-to-9.0.90"],"how_to_check":"- Check the installed Shortcutter 2 version on the Android device (Settings > Apps) and look for `9.0.48` or earlier\n- Confirm the app package in use with the vendor's build metadata; the sources do not give a package name","fix":"- Update Shortcutter 2 to `9.0.90` or later, per the sources","status":"open","published_at":"2026-10-20T12:17:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:47+00:00","updated_at":"2026-10-25T04:24:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:24:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update Shortcutter 2 to `9.0.90` or later, per the sources","reach":"local","title":"Shortcutter 2 Android app: component export flaw lets local apps reach internals","impact":"medium","summary":"Shortcutter 2 version 9.0.48 for Android has an improper export of application components, reached through a Class.forName call in ToggleGeneric.java that takes an attacker-controlled class name. A local app on the same device can use it to reach components it should not, and a public exploit has been disclosed.","category":"package","nicknames":[],"who_cares":["android","shortcutter-2","mobile"],"confidence":0.6,"needs_auth":"unknown","worst_case":"local app reaches exported components it should not","analyst_note":"","how_to_check":"- Check the installed Shortcutter 2 version on the Android device (Settings > Apps) and look for `9.0.48` or earlier\n- Confirm the app package in use with the vendor's build metadata; the sources do not give a package name","needs_analyst":false,"not_affected_if":["updated-to-9.0.90","no-untrusted-local-apps"],"who_is_affected":"Android users running Shortcutter 2 `9.0.48` or earlier on a device where other apps or local processes can run. The sources describe local access as required, so exposure depends on whether untrusted apps share the device. Devices already on `9.0.90` or later are not affected by this issue.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3416,"output_tokens":524,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113385':15A,18A '-2':23B '-2026':14A,17A '2':2A,25B,84C '9.0.48':27B,86C '9.0.90':136C 'access':114C 'address':140C 'affect':91C,149C,170C 'android':3A,19B,29B,88C,110C 'app':4A,10A,54B,85C 'applic':35B,111C 'approach':118C 'argument':103C 'attack':48B,120C 'attacker-control':47B 'call':41B 'capabl':138C 'class':50B,104C 'class.forname':40B,94C 'compon':5A,36B,64B,112C,150C 'contact':154C 'control':49B 'cve':13A,16A 'devic':58B 'disclos':74B,125C 'earli':155C 'exploit':71B,122C 'export':6A,33B,108C 'file':97C 'fix':166C 'flaw':7A 'found':79C 'function':93C 'improp':32B,107C 'intern':12A 'issu':90C,142C 'lab':82C 'lead':105C 'leedroid':81C 'let':8A 'local':9A,53B,113C 'manipul':100C 'manner':161C 'may':130C 'mobil':20B 'name':51B 'packag':21B 'product':171C 'profession':160C 'public':70B,128C 'quick':163C 'reach':11A,37B,63B 'releas':164C 'requir':116C 'respond':156C 'shortcutt':1A,22B,24B,83C 'suggest':145C 'take':45B 'togglegeneric.java':43B,98C 'upgrad':133C,147C 'use':60B,132C 'vendor':152C 'version':26B,135C,167C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Android users running Shortcutter 2 `9.0.48` or earlier on a device where other apps or local processes can run. The sources describe local access as required, so exposure depends on whether untrusted apps share the device. Devices already on `9.0.90` or later are not affected by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T12:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113385","severity":null,"published_at":"2026-10-20T12:17:29+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}