Vulnerability Description
The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.
Related Weaknesses (CWE)
References
- https://fluidattacks.com/advisories/grin
- https://play.google.com/store/apps/details?id=com.macymind.calculatorlock
FAQ
What is CVE-2026-77875?
CVE-2026-77875 is a documented vulnerability. The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, suc...
How severe is CVE-2026-77875?
CVSS scoring is not yet available for CVE-2026-77875. Check NVD for updates.
Is there a patch for CVE-2026-77875?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.