CVE-2026-96614: Improper authorization in handler for custom URL scheme in GEO CORPORATION "ゲオアプリ" for Android

CVE-2026-96614 describes an improper authorization vulnerability in the handler for a custom URL scheme in GEO CORPORATION's "ゲオアプリ" Android application. The vulnerability allows an attacker to cause the in-app browser to navigate to arbitrary websites. This behavior can be exploited to conduct phishing attacks or to disclose session identifiers of services accessed through the app. The CVSS 3.0 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation may lead to phishing attacks targeting users of the app by redirecting the in-app browser to malicious websites. Additionally, it may result in disclosure of session IDs, potentially compromising user sessions and sensitive information. There is no indication of impact on system availability.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should exercise caution with links opened within the app and monitor for suspicious activity.