CVE-2026-3667 Details

A broken authorization vulnerability has been identified in the Freedom Factory dGEN1 phone, specifically in the Android launcher application 'org.ethosmobile.ethoslauncher', prior to version 20260221. The vulnerability arises in an exported service called 'FakeAppService', which improperly validates the identity of calling applications. Instead of using secure methods to verify the caller's UID or application signature, the service relies on untrusted data from intent extras. This flaw allows any local application to impersonate a trusted source and manipulate launcher entries known as 'FakeApps'. Exploitation of this vulnerability could lead to phishing attacks and user deception.

To address this vulnerability, developers should avoid using caller-supplied values for authorization checks. Instead, validate the calling application using 'Binder.getCallingUid()' and package manager verification. Additionally, enforce a signature-level custom permission on the service and mark it as 'android:exported="false"' if external access is not needed. It's also recommended to restrict 'FakeApp' management APIs to internal components only.