CVE-2026-107020 Details
Description
An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL.
A vulnerability in the FeedEx/Handy News Reader application, specifically in version 1.1.6, allows an installed app to force the user to fetch a URL without their consent. This issue arises from an exported activity, 'LoadLinkLaterActivity', which is accessible to other applications and does not require any permissions or user interaction. The activity extracts URLs from the shared text and initiates a fetch operation, potentially leading to unauthorized data retrieval or exploitation.
As of now, no fix has been released for this vulnerability. However, it is recommended to update the activity's export status or add a permission requirement to prevent unauthorized access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107020.md | CISA-ADP | AdvisoryExploitRemedy |
| https://f-droid.org/packages/ru.yanus171.feedexfork/ | [email protected] | ProductVendor |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107020.md | [email protected] | AdvisoryExploitRemedy |
| https://github.com/yanus171/Handy-News-Reader/issues/941 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/yanus171/Handy-News-Reader/issues/952 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| FeedEx Handy Reading | 116 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |