CVE-2026-107032

Summary

Insecure permissions in Bulk Share : Location Sender v2.1.0 allow unauthenticated remote attackers to invoke an exported Android component, leading to unauthorized access to sensitive location data and control over data flow without user interaction.

Exploitability

Exploitation is trivial for remote attackers due to the absence of authentication, authorization, or user interaction requirements.

Blast radius

Successful exploitation enables full compromise of user location privacy and potential manipulation of shared location data across devices or services relying on this app.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Bulk Share : Location Sender version 2.1.1 or later, which patches the insecure exported component permissions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.