CVE-2026-13514: Chess App Information Disclosure Flaw

CVE-2026-13514 Overview

CVE-2026-13514 affects the Chess Play and Learn App for Android through version 4.9.42. The weakness resides in the AndroidManifest.xml file of the com.chess component. The manifest exposes a backup file to an unauthorized control sphere, classified under [CWE-285] Improper Authorization. An attacker with physical access to the device can extract application data through the exposed backup mechanism. A public exploit has been disclosed. The vendor confirmed the report but noted their bug bounty program excludes physical-access attacks.

Critical Impact
An attacker with physical access to an Android device can extract Chess Play and Learn App data by leveraging the exposed backup configuration in the app manifest.

Affected Products

Chess Play and Learn App for Android (com.chess) versions up to and including 4.9.42
Android devices running the vulnerable package
Google Play distribution of the com.chess application

Discovery Timeline

2026-06-29 - CVE-2026-13514 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13514

Vulnerability Analysis

The vulnerability stems from an insecure configuration in the Android application manifest. Android applications declare backup behavior through attributes in AndroidManifest.xml, and misconfigured values allow the Android Backup Manager to include sensitive application data in device backups. When android:allowBackup is enabled without restrictive rules, application-private data becomes accessible through adb backup operations on a physically accessible device.

An attacker who obtains physical access can enable USB debugging or use existing debug channels to invoke a full application backup. The resulting archive contains files from the app's private storage sandbox, which may include cached credentials, session tokens, or gameplay state. This class of issue is tracked under [CWE-285] Improper Authorization because the platform authorization model relies on the manifest declaration to restrict backup exposure.

Root Cause

The root cause is a permissive backup declaration in the com.chessAndroidManifest.xml. The application does not restrict which files participate in backup, so the Android platform includes private data that the developer did not intend to expose. See the VulDB CVE-2026-13514 entry for the technical write-up.

Attack Vector

Exploitation requires physical possession of an unlocked or debuggable Android device. The attacker connects the device over USB, invokes an Android Debug Bridge backup command against the com.chess package, and inspects the resulting archive on a workstation. No network access, elevated privileges on the target, or user interaction beyond physical control is required. Refer to the public disclosure repository for the proof-of-concept steps.

Detection Methods for CVE-2026-13514

Indicators of Compromise

USB debugging enabled on managed mobile devices that host the com.chess package without a documented business need
Presence of .ab (Android Backup) archive files on workstations that reference the com.chess package name
Unexpected adb backup command history on endpoints paired with corporate mobile devices

Detection Strategies

Inventory installed Android packages across managed devices and flag versions of com.chess at or below 4.9.42
Audit AndroidManifest.xml backup attributes during mobile application vetting to identify apps with permissive backup settings
Alert on adb process execution against corporate endpoints where mobile device management does not authorize local backups

Monitoring Recommendations

Use mobile device management telemetry to detect USB debugging state changes on enrolled devices
Correlate physical access events, such as lost or stolen device reports, with mobile app inventory to prioritize response
Track vendor advisories for the com.chess package and update the mobile app allowlist when a patched version ships

How to Mitigate CVE-2026-13514

Immediate Actions Required

Update Chess Play and Learn App to a version later than 4.9.42 once the vendor publishes a fix through Google Play
Disable USB debugging on all managed Android devices unless required for a documented workflow
Enforce device encryption and screen lock policies to raise the barrier for physical-access attacks
Restrict installation of the com.chess package on devices that handle sensitive corporate data until a patched build is available

Patch Information

The vendor acknowledged the report and stated they will address the issue, according to the VulDB advisory. At the time of publication no patched version was listed in NVD. Monitor the Google Play listing for com.chess for release notes indicating a fix above version 4.9.42.

Workarounds

Enroll devices in mobile device management and disable local backup operations through policy
Prohibit connecting corporate Android devices to untrusted workstations that could initiate adb backup
Wipe and re-provision devices before repurposing them to remove residual application data from earlier installs

bash

# Example: query installed version of com.chess via adb on a managed device
adb shell dumpsys package com.chess | grep versionName

# Example: disable USB debugging enforcement via MDM policy (conceptual)
# Set "USB debugging" = Disallowed
# Set "Backup service" = Disallowed for com.chess