Bander Notepad: Exported content provider exposes notes
Bander Notepad (bander.notepad) version code 12 exports its note content provider without a permission requirement. Any app installed on the same Android device, without any permissions, can read existing notes and insert new ones into the victim's note database. The victim app must have been launched once so that its database exists. The CVE record is marked Deferred and the upstream project appears abandoned, so no fix is known.
Bander · Bander Notepad
