Mobile

A public Proof of Concept has been released for CVE-2025-0098, an activity token leak vulnerability in the Android framework allowing arbitrary startActivity() calls due to insufficient process identifier validation.

Multiple vulnerabilities in Apple iOS and iPadOS allow unauthorized access, privilege escalation, or system crashes via malicious files, network traffic, or web pages.

A heap-based buffer overflow in the media.swcodec component of Google Android 16.0 allows for remote code execution via a ROP chain triggered by a maliciously crafted video file.

SmsForwarder through version 3.5.0 contains a missing authentication vulnerability in its embedded AndServer HTTP server, allowing attackers to remotely control the application and access sensitive data.

CVE-2026-0023 allows a malicious installer to suppress security warnings by manipulating internal installation flags, potentially facilitating the installation of malicious updates for legitimate applications.

The Midnight Mimosa campaign utilizes platform-signed, pre-installed malware on low-cost MediaTek Android devices to execute ad fraud, click fraud, and residential-proxy botnet enrollment.

A flaw in the Capacitor WebView navigation guard allows attackers to force in-app navigation to an internal proxy path, enabling the execution of arbitrary remote content within the application's origin.

Multiple vulnerabilities in Samsung's Android implementation allow remote or local attackers to achieve arbitrary code execution with root privileges, escalate permissions, and cause denial-of-service.

Chinese-speaking threat actors are using the AppPanda phishing platform to distribute the PanDa Android RAT via Meta Ads, targeting Spanish-speaking users in Mexico to harvest banking credentials.

CVE-2019-6447 allows unauthenticated attackers on a local Wi-Fi network to execute arbitrary commands and exfiltrate files from Android devices running vulnerable versions of ES File Explorer.

The Q1 2026 mobile threat landscape saw a decrease in overall attack volume driven by reduced adware and RiskTool detections, while the number of unique users targeted remained stable, with new SparkCat variants on app stores and increased banking Trojan and Triada backdoor activity.

Samsung released a security update to address multiple vulnerabilities in Samsung mobile devices running versions prior to SMR-MAY-2026 Release 1, potentially allowing attackers to exploit these vulnerabilities for malicious purposes.