high advisory October 30, 2026

Share to Clipboard: Insecure permissions clipboard overwrite (CVE-2026-107026)

An insecure permission vulnerability in Share to Clipboard version 1.14.1 allows unauthorized local attackers to arbitrarily overwrite the clipboard content of other users on the device.

Triage facts

Revision 1

Applicability: Share to Clipboard (1.14.1)
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Oct 30, 01:10 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

CVE-2026-107026 describes an insecure permission vulnerability in the Android application "Share to Clipboard" version 1.14.1 (versionCode 32). This flaw permits an unauthorized actor to perform unauthorized writes to the system clipboard, effectively allowing them to overwrite data stored by other users on the same device. The impact is primarily a compromise of the clipboard's integrity and potential information manipulation or injection.

Impact

Successful exploitation allows an unauthorized party to overwrite clipboard data, which could be leveraged to replace legitimate content with malicious links, credentials, or other payloads intended for the victim to paste inadvertently.

Recommendation

Identify all devices within the environment that have "Share to Clipboard" version 1.14.1 (versionCode 32) installed.
Remove or restrict the usage of the affected application until a vendor-provided update is confirmed.
Implement mobile device management (MDM) policies to audit or block applications with insecure local IPC (Inter-Process Communication) permissions.

Immediate actions

Inventory and remove Share to Clipboard version 1.14.1 from managed devices

IT Operations 24h

Threat Hunt

Monitor for unauthorized modification of system clipboard service

medium medium confidence hunt now

Data: Android system logcat / audit logs for clipboard service access

Mitigations

Uninstall vulnerable application until patch is applied

immediate IT Operations

CVE-2026-107026