Executive brief
YAMAP is a popular Android app for social hiking and GPS tracking used by outdoor enthusiasts to plan and record mountain expeditions. The app's built-in browser component fails to properly validate external inputs and has overly broad permissions enabled, allowing malicious apps on the same device to leak sensitive data from YAMAP or redirect users to fraudulent websites. No active exploitation has been detected, but the risk exists when a device also has a compromised app installed.
Technical details
The vulnerability is an improper access control flaw (CWE-940: Improper Verification of Source of a Communication Channel) in the WebView component of YAMAP for Android. The in-app browser fails to validate input from external sources and retains unnecessary permissions, allowing other applications on the device to interfere with it. An attacker with a malicious app installed can cause the YAMAP in-app browser to display internal app data or redirect to attacker-controlled websites. User interaction (opening the WebView) is required. The vulnerability affects v17.1.0 and earlier; a patch was released on 2026-08-31 in version v17.2.0 available via Google Play.
Affected products
- YAMAP YAMAP -Social Trekking GPS App v17.1.0 and earlier
Timeline
- 2026-09-14: disclosed
- 2026-08-31: patched: v17.2.0 released