Chess Play and Learn App up to 4.9.42 on Android com.chess AndroidManifest.xml backup

Summaryinfo

A vulnerability categorized as problematic has been discovered in Chess Play and Learn App up to 4.9.42 on Android. Impacted is an unknown function of the file AndroidManifest.xml of the component com.chess. Such manipulation leads to backup. This vulnerability is uniquely identified as CVE-2026-13514. The attack can be executed directly on the physical device. Moreover, an exploit is present. It is advisable to upgrade the affected component. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher.

Detailsinfo

A vulnerability was found in Chess Play and Learn App up to 4.9.42 on Android and classified as problematic. Affected by this issue is an unknown functionality of the file AndroidManifest.xml of the component com.chess. The manipulation with an unknown input leads to a backup vulnerability. Using CWE to declare the problem leads to CWE-530. A backup file is stored in a directory or archive that is made accessible to unauthorized actors. Impacted is confidentiality.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-13514. The exploitation is known to be easy. Local access is required to approach this attack. No form of authentication is required for exploitation. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher. By approaching the search of inurl:AndroidManifest.xml it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at play.google.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Android App Software

Vendor

• Chess

Name

• Play and Learn App

Version

• 4.9.0
• 4.9.1
• 4.9.2
• 4.9.3
• 4.9.4
• 4.9.5
• 4.9.6
• 4.9.7
• 4.9.8
• 4.9.9
• 4.9.10
• 4.9.11
• 4.9.12
• 4.9.13
• 4.9.14
• 4.9.15
• 4.9.16
• 4.9.17
• 4.9.18
• 4.9.19
• 4.9.20
• 4.9.21
• 4.9.22
• 4.9.23
• 4.9.24
• 4.9.25
• 4.9.26
• 4.9.27
• 4.9.28
• 4.9.29
• 4.9.30
• 4.9.31
• 4.9.32
• 4.9.33
• 4.9.34
• 4.9.35
• 4.9.36
• 4.9.37
• 4.9.38
• 4.9.39
• 4.9.40
• 4.9.41
• 4.9.42

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #838880: Chess.com Chess - Play and Learn (Android) 4.9.42 Information Disclosure (by honest_corrupt)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion