CVE-2026-113385 Details
Description
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability exists in LeeDrOiD Labs Shortcutter 2 App version 9.0.48 on Android. The issue arises in the ToggleGeneric.java file, where the Class.forName function is misused, leading to the improper export of Android application components. This vulnerability requires local access to exploit. The problem has been publicly disclosed and can be exploited. Users are advised to upgrade to version 9.0.90, which addresses this issue.
Users are recommended to upgrade to LeeDrOiD Labs Shortcutter version 9.0.90, which includes the necessary fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.google.com/document/d/1_CRu5x_2OFJc-iZCP_GI0L88rEUOlgs3TCv9jM5L-b4/edit?usp=sharing | [email protected] | Partial Content |
| https://play.google.com/store/apps/details?id=com.leedroid.shortcutter | [email protected] | ProductVendor |
| https://vuldb.com/cve/CVE-2026-113385 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1003932 | [email protected] | Permission Required |
| https://vuldb.com/vuln/422658 | [email protected] | Permission Required |
| https://vuldb.com/vuln/422658/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-926 | Improper Export of Android Application Components | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LeeDrOiD Labs Shortcutter 2 | 9.0.48 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |