External risk intelligence

wbpxre150 Shopping List Component Vulnerability Allows Data Manipulation.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-107028

This vulnerability affects a local mobile application (Shopping List v11.0). Android application components are typically restricted to the device's internal environment. While exported, they are not designed as internet-facing services, gateways, or public web APIs, making public internet exposure in common deployments very unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Shopping List application, specifically affecting its data handling due to insecure permissions. This flaw could potentially allow unauthorized access and manipulation of shopping list information. The primary concern at this time is to confirm if this application is in use within our environment.

Flaw allows unauthorized shopping list data access.
Relevant if the Shopping List app is deployed.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by interacting with an exported component of the shopping list application. This would allow them to access or modify the shopping list data without needing any special privileges or user interaction.

No authentication required.
Triggered by invoking exported component.
Allows manipulation of shopping list data.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthorized attacker could invoke an exported component of the Shopping List application, potentially leading to the manipulation of shopping-list data.

Shopping list data.
Invoking an exported component.
Alteration of shopping list contents.

Operational Fix

Recommended remediation, mitigation, and detection steps

Insecure permissions in the Shopping List app present a risk of unauthorized data manipulation. Technical leaders and security teams should prioritize identifying instances of this app, assessing its business criticality, and locating the accountable owner. Subsequent remediation planning should be risk-based, considering factors like data sensitivity and user impact.

Application owner(s) should manage the issue.
Verify app presence and exposure first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is wbpxre150 Shopping List?

wbpxre150 Shopping List is an Android application designed for managing personal inventory or shopping items. It is distributed via platforms like F-Droid and functions as a standalone mobile tool stored and executed directly on a user's device.

What does CWE-284 mean for CVE-2026-107028?

CWE-284 refers to Improper Access Control. In the context of this CVE, it means the application fails to correctly restrict who can interact with its internal software parts. Because of these weak permission settings, a third party can access or change data within the app without needing authorization.

How can an attacker trigger this vulnerability?

The flaw is triggered by directly invoking an exported component of the application. An exported component is a part of the app meant for communication, but here it lacks protection. Simply having the app installed is not enough; the attacker must use specific techniques to send commands to this vulnerable interface. It does not trigger through normal, intended user interaction with the app's interface.

Is my device vulnerable to this attack?

According to Halo Surface Signal, this is highly unlikely for most users. While the component is technically exported, it is not an internet-facing service or a public web API. Since this is a local mobile app, it is designed to run within the device's own sandbox environment rather than accepting traffic from the public internet.

Do I need to take action if I have this app?

Start by confirming if the application is present in your environment. Since this involves data manipulation, prioritize identifying who owns or uses the app. Once identified, evaluate the sensitivity of the shopping data it stores and follow your standard process for managing or updating mobile software to mitigate potential risks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.