CVE-2026-12189

Vulnerability

The Moovit Bus & Public Transit App version 1.18 for Android contains an exported and browsable WebViewActivity (com.moovit.web.WebViewActivity) that accepts externally supplied URLs via intents without proper validation or domain restriction [1]. This improper authorization in the handler for the custom URL scheme allows loading arbitrary web content inside the application's trusted interface. The activity is configured with an intent filter for android.intent.action.VIEW, android.intent.category.DEFAULT, and android.intent.category.BROWSABLE, making it accessible from other applications or through malicious deep links [1].

Exploitation

An attacker with local access to the device can invoke the vulnerable activity via the Android Debug Bridge (adb) using a command such as: `` adb shell am start -n com.tranzmate/com.moovit.web.WebViewActivity --es url "https://evil.com" ``

This launches the WebView and loads the attacker-controlled URL inside the legitimate app context [1]. Local access is required; the attack cannot be triggered remotely. The exploit has been published and may be used [1].

Impact

Successful exploitation allows an attacker to display arbitrary web content within the Moovit application interface [1]. This can lead to phishing attacks, UI spoofing, and social engineering, potentially resulting in credential theft, disclosure of personal information, and erosion of user trust. The attacker gains no elevated privileges on the device but can abuse the trusted application context to deceive users.

Mitigation

The vendor was contacted but did not respond to the disclosure [1]. As of the publication date (2026-06-14), no official fix or patch has been released. Users are advised to avoid opening suspicious links or deep links that may trigger the vulnerable activity. Until a patch is provided, the application remains exposed to this local exploitation vector.