---
id: "CVE-2026-113385"
kind: "vulnerability"
aliases: ["CVE-2026-113385"]
title: "Shortcutter 2 Android app: component export flaw lets local apps reach internals"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["android", "mobile", "package", "shortcutter-2"]
not_affected_if: ["no-untrusted-local-apps", "updated-to-9.0.90"]
published_at: "2026-10-20T12:17:29+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113385", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Shortcutter 2 Android app: component export flaw lets local apps reach internals

Shortcutter 2 version 9.0.48 for Android has an improper export of application components, reached through a Class.forName call in ToggleGeneric.java that takes an attacker-controlled class name. A local app on the same device can use it to reach components it should not, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Shortcutter 2 version on the Android device (Settings > Apps) and look for `9.0.48` or earlier
- Confirm the app package in use with the vendor's build metadata; the sources do not give a package name

## Fix

- Update Shortcutter 2 to `9.0.90` or later, per the sources

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113385

## From the sources

A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_