GHSL-2026-108: Local apps can silently import malicious settings into OsmAnd - CVE-2026-65997
Published Oct 1, 2026
·Updated
A zero-permission application can send privileged intent extras to OsmAnd's exported MapActivity and silently import attacker-controlled OSF settings.
Affected Software
1 affected component
Osmand Osmand
Event History
Oct 1, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
Can an unprivileged application on the same device exploit this issue?
Yes. A zero-permission application can send privileged intent extras to OsmAnd's exported MapActivity.
2
What is the resulting impact of a successful exploit?
OsmAnd can silently import attacker-controlled OSF settings.