CVE-2026-18604 in Text Message and Call App
Summary
by MITRE • 08/03/2026
A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability resides within the textPlus Text Message and Call App version 8.3.5 and earlier on Android platforms, specifically targeting the DialerActivity component within the com.gogii.textplus package. The flaw represents a critical security oversight that allows for improper export of application components, creating an avenue for unauthorized access and manipulation of the application's core functionality. The vulnerability's impact extends beyond simple data exposure as it fundamentally compromises the application's integrity by enabling malicious actors to interact with components that should remain restricted within the application's internal architecture.
The technical implementation of this vulnerability stems from inadequate component export controls within the Android application manifest file. When application components are improperly exported, they become accessible to other applications installed on the same device without proper authentication or authorization mechanisms. This misconfiguration allows local attackers to invoke the DialerActivity component directly through intent broadcasts, bypassing normal application security boundaries that should prevent such unauthorized access patterns. The vulnerability demonstrates a clear violation of the principle of least privilege as defined in cybersecurity frameworks and represents a specific instance of improper access control that can be categorized under CWE-284.
The operational impact of this vulnerability is significant for users of the textPlus application, as it enables local exploitation that could lead to unauthorized access to calling functionality and potentially sensitive user data. Attackers can leverage this flaw to initiate calls, manipulate dialing operations, or even redirect communications through the compromised component. The fact that a publicly available exploit exists increases the risk profile substantially, as it removes the requirement for advanced technical skills or extensive reconnaissance to capitalize on this weakness. This vulnerability directly aligns with several tactics outlined in the MITRE ATT&CK framework under the initial access and execution phases, specifically targeting application access and privilege escalation techniques.
The security implications extend beyond immediate exploitation as the vulnerability creates a persistent backdoor within the application's architecture that could be used for more sophisticated attacks. The local nature of the attack means that compromise requires physical access to the device or the ability to install malicious applications with similar permissions, but once exploited, the attacker gains substantial control over the application's dialer functionality. Mitigation strategies should focus on immediate application updates from the vendor, proper component export management in the Android manifest, and implementation of additional security controls such as intent filtering and permission verification mechanisms. System administrators and users should also consider immediate patching procedures and monitoring for suspicious application behavior that might indicate exploitation attempts. The vulnerability underscores the importance of proper Android application security practices and highlights the critical need for comprehensive security testing during application development lifecycle phases to prevent such exposure patterns from reaching production environments.