CVE-2026-85125 Details
Description
The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites.
A vulnerability allowing improper access control has been identified in the YAMAP - Social Trekking GPS App for Android, specifically in versions through 17.1.0. This vulnerability arises from inadequate validation of external input in the in-app browser's WebView component, which could lead to information leakage from the application or unintended redirections to external websites.
Users are advised to update the YAMAP application to version 17.2.0 or later, available on the Google Play Store.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://info.yamap.com/archives/8173 | [email protected] | AdvisoryRemedyVendor |
| https://jvn.jp/en/jp/JVN69877538/ | [email protected] | AdvisoryRemedy |
| https://play.google.com/store/apps/details?id=jp.co.yamap&hl=en | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-940 | Improper Verification of Source of a Communication Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YAMAP | <v17.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |