External risk intelligence

LeafPad Note Reading Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-107034

This vulnerability affects a local Android application (LeafPad/Leaf Note) that stores user data on a device. It is a client-side application typically used for local note-taking and does not function as a network service, web application, or internet-facing gateway, making public internet exposure and remote reachability for this specific vulnerability very unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in LeafPad/Leaf Note, an Android note-taking application. The issue arises from insecure permissions, potentially allowing unauthorized access to user note data. While the application is client-side and not a network service, confirming its presence and potential exposure within the organization is prudent.

Insecure app permissions expose user notes.
Potential for unauthorized access to sensitive data.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could gain access to sensitive user notes without authentication. This occurs because the application doesn't properly protect data, allowing unauthorized reading of another user's notes. When successful, this could lead to the exposure of private information.

No authentication required.
Unauthorized reading of note data.
Exposure of sensitive user information.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthorized attackers could arbitrarily read another user's note data stored by LeafPad/Leaf Note. This is possible due to insecure permissions within the application, which does not appear to be a network service.

Other users' notes.
Unauthorized reading of note data.
Exposure of sensitive personal notes.

Operational Fix

Recommended remediation, mitigation, and detection steps

LeafPad/Leaf Note, an Android application, has a vulnerability that could allow unauthorized users to access sensitive note data. Ownership of this issue will likely fall to the application owner and mobile platform team responsible for managing deployed Android applications. The first step is to identify all devices running this application, confirm the business criticality of the data stored within it, and then assess the risk to plan for remediation.

Application owners and mobile platform teams.
Confirm affected devices and data criticality.
Plan targeted remediation or data mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LeafPad / Leaf Note?

LeafPad, also known as Leaf Note, is a lightweight note-taking application designed for the Android operating system. It provides users with a simple interface to create and store text-based notes directly on their mobile devices. Because it operates as a local client-side tool, it is primarily used for personal information management rather than complex data processing.

What is the vulnerability in CVE-2026-107034?

This vulnerability is classified as CWE-284, which concerns improper access control. In this context, the software fails to enforce proper permissions on the files where it stores notes. Consequently, the application does not correctly restrict who can view stored content, allowing a user or process without legitimate authorization to read note data created by another user on the same device.

How does an attacker trigger this vulnerability?

An attacker needs the ability to interact with the device's file system or the application's data storage to access these notes. It is important to note that because LeafPad is not a network-accessible service, simply being on the internet does not trigger this bug; the attacker generally must have an established presence or access vector on the specific Android device where the application is installed.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable via the public internet. Since LeafPad is a local Android application and not an internet-facing gateway or web service, it lacks the network exposure typically required for remote exploitation. Your primary concern should be unauthorized access from other users or malicious apps already present on the physical device.

Do I need to take action if I use LeafPad?

Yes, you should start by auditing your mobile fleet to identify which devices have this version of LeafPad installed. Once identified, evaluate the sensitivity of the notes stored in the app. Coordinate with your mobile device management team to monitor for official updates or to consider transitioning to a more secure note-taking solution if the data stored is highly confidential.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.