CVE-2026-107027 Details

A vulnerability in Lz233 Tarnhelm version 1.8.2 (20250630) for Android has been identified, allowing unauthorized access to exported components. This issue arises from insecure permissions, enabling attackers to invoke an exported headless activity that writes caller process text into the system clipboard without confirmation or proper checks. The vulnerability could lead to arbitrary data access and overwriting, as the clipboard content is silently replaced with attacker-specified text.

As of October 2026, no fix has been released. It is recommended to add an android:permission to the affected component or set android:exported to 'false' where external access is not intended.