CVE-2026-107024 in Share 2 Archive Today
Summary
by MITRE • 10/29/2026
Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified within Share 2 Archive Today, specifically affecting version code sixty-one, represents a critical failure in the application’s access control mechanisms regarding inter-process communication and system-level permissions. This flaw stems from an insecure configuration of file or data storage permissions that allows one application instance to read or write resources intended for exclusive use by another user session or process. In modern Android environments, applications are typically sandboxed to prevent such cross-user interference; however, when permissions like READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE are granted without proper isolation checks, or when shared preferences and clipboard data are stored in world-readable directories, the security boundary is effectively bypassed. The specific manifestation of this flaw involves the manipulation of the system clipboard, a sensitive area where users often paste credentials, personal identification numbers, financial details, or private messages. By exploiting insecure permissions, an attacker can gain unauthorized read access to another user's clipboard contents and write arbitrary data into it, thereby compromising both confidentiality and integrity of user input.
From a technical perspective, the operational impact is severe because the attack vector relies on supplying a crafted URL rather than requiring complex exploitation techniques or physical proximity in many scenarios. This suggests that the vulnerability may be triggered through intent filters or deep links within the application itself. When an attacker constructs a malicious URI and induces the victim to open it, either directly or via social engineering, the application processes this input without validating whether the current context has the authority to modify global system states like the clipboard. The ability to arbitrarily overwrite another user's clipboard content means that subsequent actions taken by the victim after opening the crafted URL will be based on false information injected by the attacker. This can lead to a variety of malicious outcomes, including credential theft if the victim attempts to paste stolen data into login fields, financial fraud through the substitution of bank account numbers or cryptocurrency wallet addresses during transactions, and general disruption of workflow leading to potential loss of trust in the application’s reliability.
This vulnerability aligns closely with Common Weakness Enumeration categories such as CWE-732 Incorrect Permission Assignment for Critical Resource, which describes situations where permissions are assigned too broadly, allowing unintended actors to access or modify sensitive data. Furthermore, it relates to CWE-918 Server-Side Request Forgery if the crafted URL triggers internal requests that leverage these insecure permissions, and potentially CWE-602 Client-Side Injection of Scripting Language if the clipboard manipulation is part of a broader cross-site scripting attack chain in hybrid app contexts. In terms of the MITRE ATT&CK framework for mobile platforms, this behavior corresponds to techniques involving Data from Information Repositories or Input Capture, specifically targeting clipboard data which is often overlooked by users and security tools alike as a high-value target for credential harvesting. The lack of proper validation on incoming URLs allows an attacker to bypass standard security controls that might otherwise restrict access based on the source or integrity of the input data.
Mitigation strategies must focus on enforcing strict least-privilege principles within the application’s architecture. Developers should immediately audit all file system operations and clipboard interactions to ensure they are confined to private app directories rather than public storage areas accessible by other applications. It is essential to implement rigorous validation for any URLs or intents received by the application, ensuring that only trusted sources can trigger actions that modify global state like the clipboard. Utilizing Android’s JobScheduler or WorkManager with appropriate permissions checks can help isolate sensitive operations. Additionally, implementing runtime permission requests where necessary and avoiding hardcoded broad permissions in the manifest file will reduce the attack surface. For users currently affected by this vulnerability, it is recommended to update to a patched version of Share 2 Archive Today as soon as available. Until then, exercising caution when opening links from untrusted sources and manually verifying clipboard contents before pasting sensitive information can mitigate some risks associated with this insecure permission flaw.