Improper Export of Android Application Components in textPlus App by Textplus, Inc.
CVE-2026-18604

4.8MEDIUM

Key Information:

Vendor: Textplus
Status: Text Message And Call App
Vendor: CVE Published:; 3 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18604?

A vulnerability found in the textPlus Text Message and Call App on Android, specifically impacting version 8.3.5, allows for improper export of application components through the DialerActivity. This security flaw necessitates local access to exploit and can lead to unauthorized access to sensitive functionalities within the app. The vendor has been notified about the issue, and public exploits are available, heightening the need for users to secure their applications and update to the latest version.

Affected Version(s)

Text Message and Call App 8.3.0

Text Message and Call App 8.3.1

Text Message and Call App 8.3.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18604 - Proof of Concept