CVE-2025-15464: Yintibao Fun Print Auth Bypass Vulnerability

CVE-2025-15464 Overview

CVE-2025-15464 affects the Yintibao Fun Print Android application. The application exports an Android Activity that external applications can invoke without authorization. Attackers leverage this exported component to obtain the application context and directly launch Gmail with inbox access, bypassing intended security controls. The flaw maps to CWE-926: Improper Export of Android Application Components and results in confidentiality impact on the victim device.

Critical Impact
A malicious local app or crafted intent can invoke the exported Activity to access the victim's Gmail inbox without user consent or additional authentication.

Affected Products

Yintibao Fun Print 6.05.15 for Android
CPE: cpe:2.3:a:yintibao:fun_print:6.05.15:*:*:*:*:android:*:*
Vendor: yintibao

Discovery Timeline

2026-01-08 - CVE-2025-15464 published to NVD
2026-01-08 - KoreLogic Security Advisory KL-001-2026-001 released
2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-15464

Vulnerability Analysis

The Yintibao Fun Print Android application declares an Activity component as exported in its AndroidManifest.xml. Exported Activities are reachable by any other application installed on the device. The component does not enforce permission checks or signature verification before processing incoming intents. As a result, an external application can invoke the Activity and inherit the calling context that Fun Print uses to interact with Gmail.

Once invoked, the Activity initiates a flow that launches Gmail and exposes inbox content to the calling process. This breaks the Android security model, which assumes that inbox access requires user-granted permissions and authenticated context. The attack vector is classified as Network in CVSS metrics because the exposed Activity can be reached without local user interaction once a malicious carrier app is present.

Root Cause

The root cause is improper export of an Android Activity component. The Activity is declared with android:exported="true" and lacks intent filter restrictions, permission attributes (android:permission), or runtime caller verification. The Activity also fails to validate the source of the invoking intent before transitioning into the Gmail launch flow. This combination allows any third-party application to drive the component as if it were a trusted internal caller.

Attack Vector

A malicious application installed on the same device crafts an explicit Intent targeting the exported Activity in the yintibao.fun_print package. The intent triggers the Activity, which then launches Gmail using inherited context. The attacker application does not require special Android permissions, since the exported component itself provides the bridge to inbox content. The KoreLogic proof of concept demonstrates the invocation pattern using a JavaScript-driven test harness. See the KoreLogic PoC for Advisory KL-001-2026-001 and the KoreLogic Security Advisory KL-001-2026-001 for technical details.

Detection Methods for CVE-2025-15464

Indicators of Compromise

Installation of Yintibao Fun Print version 6.05.15 on managed Android devices
Unexpected Intent traffic targeting components within the yintibao.fun_print package from non-system applications
Gmail application launches initiated immediately after Fun Print Activity transitions in device logs

Detection Strategies

Audit AndroidManifest.xml of installed APKs for exported Activities lacking android:permission declarations
Use mobile application vetting tools to flag Fun Print 6.05.15 as vulnerable based on the published CPE
Correlate Activity launch events with subsequent Gmail process starts in Android logcat or MDM telemetry

Monitoring Recommendations

Enroll Android endpoints into a mobile threat defense or MDM solution that inventories installed packages and versions
Monitor for inter-process intent activity between unknown packages and the Fun Print package on managed devices
Track Gmail authentication and inbox access anomalies originating from device sessions where Fun Print is installed

How to Mitigate CVE-2025-15464

Immediate Actions Required

Uninstall Yintibao Fun Print version 6.05.15 from managed Android devices until a fixed release is published
Restrict installation of the Fun Print package through MDM application allowlists and blocklists
Audit Gmail account activity on devices where the vulnerable version was installed for unauthorized inbox access

Patch Information

No vendor patch or fixed version is referenced in the published advisories. Review the KoreLogic Security Advisory KL-001-2026-001 and the Full Disclosure January 2026 post for vendor coordination status and any subsequent fix announcements. Track the NVD entry for CVE-2025-15464 for patch updates.

Workarounds

Remove the application from devices that store sensitive Gmail accounts
Use Android work profile separation to isolate Gmail from untrusted applications
Restrict sideloading and enforce Google Play Protect scanning on all managed devices

bash

# Example MDM policy to block the vulnerable package on Android
adb shell pm uninstall --user 0 com.yintibao.fun_print