CVE-2025-65835: Null Pointer Dereference
The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses Intent.EXTRACHOSENCOMPONENT without checking for null. If a broadcast is sent with extras present but without EXTRACHOSENCOMPONENT, the code dereferences a null value and throws a NullPointerException. Because the receiver is exported and performs no permission or caller validation, any local application on the device can send crafted ACTIONSEND broadcasts to this component and repeatedly crash the host application, resulting in a local, unauthenticated application-level denial of service for any app that includes the plugin.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65835?
CVE-2025-65835 is categorized as a high severity vulnerability due to its potential for denial-of-service attacks.
How do I fix CVE-2025-65835?
To fix CVE-2025-65835, update the cordova-plugin-x-socialsharing to the latest version beyond 6.0.4 where the vulnerability is patched.
What are the potential impacts of CVE-2025-65835?
The potential impacts of CVE-2025-65835 include unauthorized access to sensitive information and denial of service conditions.
Which versions of cordova-plugin-x-socialsharing are affected by CVE-2025-65835?
CVE-2025-65835 affects version 6.0.4 of the cordova-plugin-x-socialsharing.
Is CVE-2025-65835 a remote or local vulnerability?
CVE-2025-65835 is primarily considered a local vulnerability, requiring an attacker to have local access to exploit it.