CVE-2026-18604: textPlus Privilege Escalation Flaw

CVE-2026-18604 Overview

CVE-2026-18604 affects the textPlus Text Message and Call App up to version 8.3.5 on Android. The flaw resides in the DialerActivity function within the com.gogii.textplus component. The vulnerability stems from improper export of Android application components [CWE-926], allowing locally installed applications to interact with DialerActivity without appropriate access controls. A public exploit has been referenced through VulDB, and the vendor was contacted before disclosure. Attackers require local access to a device with the affected app installed to abuse the exposed component.

Critical Impact
A malicious local Android application can invoke the exported DialerActivity component in com.gogii.textplus without the permissions typically required, resulting in limited impact to confidentiality, integrity, and availability of app data.

Affected Products

textPlus Text Message and Call App for Android, versions up to 8.3.5
Component com.gogii.textplus (function DialerActivity)
Vendor: Gogii

Discovery Timeline

2026-08-03 - CVE-2026-18604 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18604

Vulnerability Analysis

CVE-2026-18604 is an improper export of an Android application component [CWE-926]. In Android, activities, services, and broadcast receivers can be marked exported, allowing other apps on the device to send Intents to them. The DialerActivity in com.gogii.textplus is exposed to other installed applications without adequate protection. A malicious app installed on the same device can craft Intents that trigger the activity, potentially manipulating call-related workflows exposed by textPlus. The attack vector is local, and exploitation requires only low privileges available to any installed application on the device.

Root Cause

The root cause lies in the Android manifest and component configuration of com.gogii.textplus. The DialerActivity is declared in a manner that makes it accessible to external applications, either through an explicit android:exported="true" attribute or through the presence of an Intent filter without an accompanying permission requirement. Because no signature-level permission or runtime authorization gates access, any local app can invoke it.

Attack Vector

An attacker distributes a malicious Android application that is installed on the victim's device. The application constructs an explicit Intent targeting com.gogii.textplus/.DialerActivity and dispatches it via startActivity(). The exported activity accepts the Intent and executes its logic in the context of textPlus, allowing the attacker to influence dialer-related behavior within the app. The confidentiality, integrity, and availability impact is limited in scope to the textPlus application context.

No verified public exploit code has been reproduced for this article. See the GitHub Repository for Gogii and the VulDB CVE-2026-18604 entry for additional technical details.

Detection Methods for CVE-2026-18604

Indicators of Compromise

Presence of textPlus versions up to 8.3.5 on managed Android devices.
Installed third-party applications that issue Intents targeting com.gogii.textplus/.DialerActivity.
Unexpected outbound call attempts or dialer UI activity originating from applications other than the user or the textPlus app itself.

Detection Strategies

Inventory Android devices for the com.gogii.textplus package and record installed versions using mobile device management (MDM) telemetry.
Perform static analysis of the textPlus APK manifest to confirm the exported status of DialerActivity and identify vulnerable installations.
Review Android logcat and application-level logs on test devices for Intents received by DialerActivity from foreign package identifiers.

Monitoring Recommendations

Enroll Android endpoints in MDM or a mobile threat defense solution and monitor for installations of textPlus at or below version 8.3.5.
Alert on newly sideloaded APKs on managed devices, as local exploitation requires a second app on the same device.
Track vendor advisories and VulDB updates for a fixed release of textPlus.

How to Mitigate CVE-2026-18604

Immediate Actions Required

Update the textPlus Text Message and Call App to a version newer than 8.3.5 once the vendor publishes a fix.
Restrict installation of unverified third-party Android applications on devices where textPlus is used.
On corporate devices, enforce a policy through MDM that blocks unknown-source app installations.

Patch Information

At the time of publication, no fixed version has been listed in the NVD entry or VulDB references. Monitor the VulDB Vulnerability #385527 page and the GitHub Repository for Gogii for updates on a patched release.

Workarounds

Uninstall textPlus versions up to 8.3.5 on high-risk devices until a patched build is available.
Limit device use to trusted applications from the Google Play Store and disable installation from unknown sources.
Educate users on avoiding sideloaded applications, which are the prerequisite for local exploitation of this issue.

bash

# Example: query installed textPlus version on a connected Android device via ADB
adb shell dumpsys package com.gogii.textplus | grep versionName