A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. (CVE-2026-18604)
A vulnerability exists in the textPlus Text Message and Call App up to version 8.3.5 on Android, specifically in the DialerActivity component. This flaw allows improper export of Android application components, which can be exploited locally by an attacker with limited privileges. The vulnerability has a CVSS score of 5.3, indicating a low severity level. No patch or remediation information is currently provided by the vendor. Exploit code is publicly available, but no known exploitation in the wild has been reported.
AI Analysis
Technical Summary
CVE-2026-18604 affects the textPlus Android app up to version 8.3.5 by improperly exporting the DialerActivity component, leading to a potential local privilege escalation or information disclosure scenario. The vulnerability requires local access and low privileges to exploit and does not require user interaction. The CVSS 3.1 base score is 5.3, reflecting limited impact on confidentiality, integrity, and availability. No official patch or fix details are available, and the vendor has been contacted regarding this issue.
Potential Impact
The vulnerability allows an attacker with local access and limited privileges to manipulate the DialerActivity component due to improper export settings. This can lead to unauthorized access or actions within the app context, impacting confidentiality, integrity, and availability at a low level. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to the device and monitor for suspicious activity related to the textPlus app. No vendor-provided mitigation or temporary fix is currently documented.
A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. (CVE-2026-18604)
Description
A vulnerability exists in the textPlus Text Message and Call App up to version 8.3.5 on Android, specifically in the DialerActivity component. This flaw allows improper export of Android application components, which can be exploited locally by an attacker with limited privileges. The vulnerability has a CVSS score of 5.3, indicating a low severity level. No patch or remediation information is currently provided by the vendor. Exploit code is publicly available, but no known exploitation in the wild has been reported.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/actuator/com.gogii.textplusRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18604 affects the textPlus Android app up to version 8.3.5 by improperly exporting the DialerActivity component, leading to a potential local privilege escalation or information disclosure scenario. The vulnerability requires local access and low privileges to exploit and does not require user interaction. The CVSS 3.1 base score is 5.3, reflecting limited impact on confidentiality, integrity, and availability. No official patch or fix details are available, and the vendor has been contacted regarding this issue.
Potential Impact
The vulnerability allows an attacker with local access and limited privileges to manipulate the DialerActivity component due to improper export settings. This can lead to unauthorized access or actions within the app context, impacting confidentiality, integrity, and availability at a low level. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to the device and monitor for suspicious activity related to the textPlus app. No vendor-provided mitigation or temporary fix is currently documented.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-p4m6-fc2r-5pvm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18604"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a710659bf32cb7a34393737
Added to database: 08/03/2026, 21:21:29 UTC
Last enriched: 08/03/2026, 21:27:37 UTC
Last updated: 08/04/2026, 02:17:46 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.