CVE-2026-95180: Justson agentweb-core vulnerability
Published Oct 15, 2026
·Updated
An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient
Affected Software
1 affected component
Justson agentweb-core<=5.1.6-androidx
Event History
Oct 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which versions should be considered affected?
agentweb-core v5.1.6-androidx and earlier are identified as affected. The provided information does not state the first fixed version.
2
What level of attacker access is required?
Exploitation requires a local attacker. The issue is triggered through handling of intent:// URLs in DefaultWebClient and can expose sensitive information or launch non-exported host application components.