CVE-2026-96614: Medium severity GEO ゲオアプリ vulnerability
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker would need to induce a user to interact with a crafted custom URL scheme link. No prior privileges are required, but user interaction is required.
Who is exposed to the phishing risk?
Users of the GEO ゲオアプリ are exposed when they open an attacker-controlled custom-scheme URL. The issue can cause the app's in-app browser to load an arbitrary website, which may make phishing content appear within the application.
What information could be exposed?
The reported impact includes possible disclosure of a service session ID. The provided information does not specify which service's session ID, the affected app versions, or conditions required for disclosure.