CVE-2025-15464 - Vulnerability Details - OpenCVE

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0003.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Yintibao	Fun Print Mobile

No data.

No data.

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2026/Jan/12
https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt
https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt

History

Thu, 08 Jan 2026 23:30:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2026/Jan/12

Thu, 08 Jan 2026 22:15:00 +0000

Type	Values Removed	Values Added
References		https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 08 Jan 2026 21:15:00 +0000

Type	Values Removed	Values Added
Description		Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.
Title		KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking
First Time appeared		Yintibao Yintibao fun Print Mobile
Weaknesses		CWE-926
CPEs		cpe:2.3:a:yintibao:fun_print_mobile:6.05.15::android:::::
Vendors & Products		Yintibao Yintibao fun Print Mobile
References		https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt

MITRE

Status: PUBLISHED

Assigner: KoreLogic

Published: 2026-01-08T21:01:31.240Z

Updated: 2026-01-08T23:04:12.554Z

Reserved: 2026-01-05T20:33:47.411Z

Link: CVE-2025-15464

Vulnrichment

Updated: 2026-01-08T23:04:12.554Z

NVD

Status : Received

Published: 2026-01-08T21:15:42.980

Modified: 2026-01-08T23:15:43.783

Link: CVE-2025-15464

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15464", "assignerOrgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9", "state": "PUBLISHED", "assignerShortName": "KoreLogic", "dateReserved": "2026-01-05T20:33:47.411Z", "datePublished": "2026-01-08T21:01:31.240Z", "dateUpdated": "2026-01-08T23:04:12.554Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["Android"], "product": "Fun Print Mobile", "vendor": "yintibao", "versions": [{"status": "affected", "version": "6.05.15", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yintibao:fun_print_mobile:6.05.15:*:android:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Felix Segoviano of KoreLogic, Inc."}], "datePublic": "2026-01-08T20:55:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.<br><br><br>"}], "value": "Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-926", "description": "CWE-926 Improper Export of Android Application Components", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9", "shortName": "KoreLogic", "dateUpdated": "2026-01-08T21:01:31.240Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt"}], "source": {"discovery": "EXTERNAL"}, "title": "KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"references": [{"url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T21:29:21.276464Z", "id": "CVE-2025-15464", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T21:31:51.976Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2026/Jan/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-08T23:04:12.554Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2026/Jan/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-08T23:04:12.554Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-15464", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T21:29:21.276464Z"}}}], "references": [{"url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.poc.js.txt", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T21:24:08.509Z"}}], "cna": {"title": "KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Felix Segoviano of KoreLogic, Inc."}], "affected": [{"vendor": "yintibao", "product": "Fun Print Mobile", "versions": [{"status": "affected", "version": "6.05.15", "versionType": "semver"}], "platforms": ["Android"], "defaultStatus": "affected"}], "datePublic": "2026-01-08T20:55:00.000Z", "references": [{"url": "https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.", "supportingMedia": [{"type": "text/html", "value": "Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.<br><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-926", "description": "CWE-926 Improper Export of Android Application Components"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yintibao:fun_print_mobile:6.05.15:*:android:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9", "shortName": "KoreLogic", "dateUpdated": "2026-01-08T21:01:31.240Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15464", "state": "PUBLISHED", "dateUpdated": "2026-01-08T23:04:12.554Z", "dateReserved": "2026-01-05T20:33:47.411Z", "assignerOrgId": "bbf0bd87-ece2-41be-b873-96928ee8fab9", "datePublished": "2026-01-08T21:01:31.240Z", "assignerShortName": "KoreLogic"}, "dataVersion": "5.2"}