This vulnerability affects the Genspark AI Workspace App 2.8.4 on Android, specifically in the component ai.mainfunc.genspark. Improper authorization in the handling of a custom URL scheme allows a local attacker with limited privileges to potentially perform unauthorized actions within the app. The attack vector is limited to local access, and the vendor has not issued any advisory or fix.

An attacker with local access and limited privileges could exploit this vulnerability to bypass authorization controls in the app's custom URL scheme handler. This may lead to unauthorized operations within the app context. However, the impact is limited by the requirement for local access and the absence of user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should restrict local access to the device and monitor for updates from Genspark regarding a patch or official mitigation.