Improper access control in Justson agentweb-core intent handling
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-284.
Summary
Justson agentweb-core v5.1.6-androidx and earlier is affected. The flaw is incorrect access control in the handling of intent:// URLs in DefaultWebClient (CWE-284). A local attacker with low privileges can obtain sensitive information and launch non-exported components of the host application.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Justson agentweb-core.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-10-16 Threatist record created from CVE-2026-95180
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 6
- https://github.com/Justson/AgentWeb/releases
- https://github.com/Justson/AgentWeb/commit/9efb1519
- https://github.com/Justson/AgentWeb/blob/androidx/releasenote.md
- https://github.com/Justson/AgentWeb/blob/androidx/agentweb-core/src/main/java/com/just/agentweb/DefaultWebClient.java
- https://jitpack.io/com/github/Justson/AgentWeb/agentweb-core/maven-metadata.xml
- https://github.com/FFG0d/security-advisories/blob/main/advisories/CVE-2026-95180.md
Sources
- CVE-2026-95180 · CVE Program
- CVE-2026-95180 · NVD
- FIRST EPSS
- CVE-2026-95180 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences