Executive brief
A vulnerability in the Send Anywhere Android app allows other malicious apps on the same device to force the app to download files without user permission. These files appear in the app's trusted 'Received' list, which could trick a user into installing a malicious application (APK) or lead to the device running out of storage space. This could result in a full device compromise if the user interacts with the downloaded file.
Technical details
An improper export of the Android application component 'com.estmob.paprika4.activity.ViewActivity' (CWE-926) allows any local application, even those with no special permissions, to send an explicit VIEW intent. This intent can include an arbitrary HTTP/HTTPS URL which the application will automatically download into its scoped storage. Because the downloaded files appear in the application's trusted 'Received' interface, it creates a social engineering vector for arbitrary code execution if the user is tricked into installing a downloaded APK. Additionally, an attacker can cause a denial-of-service (DoS) by exhausting disk space through oversized file transfers.
Affected products
- Rakuten Symphony Korea, Inc. Send Anywhere (File Transfer) for Android 23.2.9
Timeline
- 2026-06-15: disclosed: CVE published to NVD