Incorrect permission assignment in AbemaTV, Inc. 'ABEMA' App for Android
Priority LOW 15CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00176 7th percentileScored 2026-11-07
Fix Fixed 'ABEMA' App for Android (AbemaTV, Inc.): 10.65.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AbemaTV, Inc. | 'ABEMA' App for Android | before 10.65.0 | 10.65.0 | Patch available | CNA |
- 'ABEMA' App for Android VendorAbemaTV, Inc. Affected before 10.65.0 Fixed in 10.65.0 Patch available CNA
Remediation
- Fix · CNA 'ABEMA' App for Android (AbemaTV, Inc.) Fixed in 10.65.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28745
- 2026-10-03 Alias added: GHSA-qcg7-33w2-mc2x
References
Sources
- CVE-2024-28745 · CVE Program
- CVE-2024-28745 · NVD
- FIRST EPSS
- GHSA-qcg7-33w2-mc2x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences