Handy News Reader: Exported activity lets apps make the reader fetch arbitrary URLs
The Android app Handy News Reader (package ru.yanus171.feedexfork, versionCode 116) exports the activity activity.LoadLinkLaterActivity without a permission check. Any app installed on the same device can send it a URL, and the reader then fetches that URL without user interaction. The advisory describes this as unattended victim-side fetching and queue insertion, with no code execution or read-back to the attacker. The CVSS 7.5 score in the input could not be verified; VulDB lists 4.3.
yanus171 · Handy News Reader (FeedEx)
