Voki Bot: Improper export of ShortcutDispatchActivity allows unauthorized automation replay
Voki Bot for Android (net.canvoki.vokibot) exports the ShortcutDispatchActivity component without a permission check. A malicious app on the same device can start it with a known trigger ID and make Voki Bot execute the user's configured automations, for example launching system settings. The attacker needs no permissions and no user interaction, but the trigger and automation must already exist in the victim's app data.
canvoki · Voki Bot
