CVE-2026-113385
Received Received - Intake

Improper Export of Android App Components in Shortcutter 2

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113385
EUVD
EUVD-2026-104961

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LeeDrOiD Labs Shortcutter 2 App 9.0.48

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-926 The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the LeeDrOiD Labs Shortcutter 2 App on Android. It involves the improper export of Android application components due to a flaw in the Class.forName function of ToggleGeneric.java. An attacker with local access can manipulate the Class argument to execute privileged actions without proper permissions.

Detection Guidance

This vulnerability requires local access to the Android device and is specific to the LeeDrOiD Labs Shortcutter 2 App versions prior to 9.0.90. Check the installed version of the app via device settings or ADB command: adb shell dumpsys package com.leedroid.shortcutter | grep versionName. If the version is below 9.0.90, the device is vulnerable.

Impact Analysis

An attacker with local access to your device could exploit this to perform privileged actions without your permission. This might include accessing sensitive data, executing unauthorized commands, or triggering unintended system behaviors through the app's exported components.

Mitigation Strategies

Upgrade the LeeDrOiD Labs Shortcutter 2 App to version 9.0.90 or later through the Google Play Store. If the app is not available for update, uninstall it temporarily until an update is provided. Ensure no untrusted apps are installed that could exploit this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart