CVE-2026-18604 Details

A vulnerability exists in the textPlus Text Message and Call App for Android, affecting versions up to 8.3.5. The issue lies in the exported DialerActivity, which lacks proper permission controls, allowing any installed application to initiate outbound calls without user interaction or required permissions. This exploitation can be done by sending specific intent extras that bypass the application's normal call handling procedures. The vulnerability could lead to unauthorized calls being made on behalf of the user, potentially to premium-rate or attacker-controlled numbers, with the victim's caller ID being spoofed to display their textPlus number.

To address this vulnerability, the app should be modified to prevent automatic call origination from intent-supplied data. Instead, require a direct user action within the app before initiating a call. Additionally, the 'DialerActivity' should be set to 'android:exported="false"' or restricted to a signature-level permission, unless external launching is necessary. If deep linking with 'tel:' or 'sip:' schemes is required, it should only be used to prefill information and not to trigger immediate calls.