CVE-2023-43955 | BDVDB-2026-220485 Detail

Description#

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/actuator/com.phlox.tvwebbrowser
https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/poc.apk
https://github.com/actuator/com.phlox.tvwebbrowser/blob/main/CWE-94.md
https://github.com/truefedex/tv-bro/pull/182#issue-1901769895

Exploit#

No public exploit known

History#

Version 12023-12-27Record published in the CVE List.
Version 22024-08-02Most recent update recorded in the CVE List.