Tarnhelm Android app: Exported activity allows clipboard overwrite
Tarnhelm 1.8.2 (versionCode 20250630) for Android exports a headless activity without a permission check. Any app installed on the same device, even one holding no runtime permissions, can start it and silently replace the clipboard content with its own text. The user's next paste may then insert attacker-controlled data. The NVD record describes the attack vector as network, but the third-party advisory describes a local attack that requires a malicious app on the device, so the actual exposure needs verification.
lz233 · Tarnhelm
