CVE-2026-73335: Myna Point Android Auth Bypass Vulnerability

CVE-2026-73335 Overview

CVE-2026-73335 is an improper authorization vulnerability [CWE-939] in the Myna Point Android application. The flaw affects the handler for a custom URL scheme, allowing a malicious application co-resident on the device to send crafted Intents to the vulnerable app. Successful exploitation can cause the affected application to execute arbitrary JavaScript within its own context. The vulnerability requires local access and user interaction, and it impacts confidentiality, integrity, and availability at a low level.

Critical Impact
A malicious app installed on the same Android device can invoke the Myna Point app through its custom URL scheme and trigger arbitrary JavaScript execution inside the affected application.

Affected Products

Myna Point Android application (jp.go.soumu.mkpf.mkpfmypage)
Distributed via Google Play — see Google Play App Details
Refer to JVN #67155805 Advisory for affected version details

Discovery Timeline

2026-08-26 - CVE-2026-73335 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-73335

Vulnerability Analysis

The Myna Point Android application registers a custom URL scheme handler that accepts Intents from other apps on the device. The handler does not adequately authorize the source of the incoming Intent or validate the data it carries. As a result, any locally installed application can craft an Intent targeting the custom scheme and pass attacker-controlled input that reaches a WebView or JavaScript execution context inside Myna Point.

Because the code executes inside the trust boundary of the target application, the injected JavaScript can interact with the app's WebView, cookies, cached content, and any JavaScript-to-native bridges exposed by the app. This provides a foothold for information disclosure and manipulation of application state within the affected app's sandbox.

Root Cause

The root cause is Improper Authorization in Handler for Custom URL Scheme [CWE-939]. The application accepts Intents matching its declared URL scheme without verifying the caller's identity or sanitizing scheme parameters before passing them to a JavaScript execution surface.

Attack Vector

Exploitation is local and requires user interaction. An attacker first convinces the victim to install a malicious app on the same Android device. That app issues an Intent targeting the Myna Point custom URL scheme with a crafted URI containing JavaScript payload data. When the user interacts with the resulting UI flow, the payload is passed to the affected handler and executed. See the JVN #67155805 Advisory for scheme-level details.

Detection Methods for CVE-2026-73335

Indicators of Compromise

Presence of unknown or sideloaded Android applications on devices that also have jp.go.soumu.mkpf.mkpfmypage installed.
Outbound network requests from the Myna Point app to domains not associated with its official backend services.
Unexpected Intent traffic from third-party apps targeting the Myna Point custom URL scheme.

Detection Strategies

Inspect installed application inventories for the affected package and verify it is running a patched version.
Review Android package manager logs for Intents delivered to the Myna Point scheme originating from non-system, non-browser callers.
Use mobile threat defense telemetry to flag apps that programmatically launch Intents against government-service URL schemes.

Monitoring Recommendations

Monitor enterprise MDM inventories for the affected package version and enforce updates through managed distribution.
Alert on installations of unvetted third-party APKs on devices that hold sensitive government-service applications.
Track anomalous WebView network activity from the Myna Point application after Intent-based launches.

How to Mitigate CVE-2026-73335

Immediate Actions Required

Update the Myna Point Android application to the latest version available on Google Play.
Audit devices for unknown or sideloaded applications and remove any that are not required.
Advise users not to tap unsolicited links or install untrusted apps that request opening jp.go.soumu.mkpf.mkpfmypage via a custom scheme.

Patch Information

Refer to the vendor's advisory published through JVN #67155805 Advisory for the fixed version. Install the updated build from the Google Play listing once available.

Workarounds

Restrict installation of non-Play Store applications on managed Android devices using MDM policies.
Enable Google Play Protect to detect potentially harmful applications that abuse Intent-based attack surfaces.
Uninstall the Myna Point application on devices that cannot be updated until a patched version is deployed.

bash

# Configuration example: verify installed version via ADB
adb shell dumpsys package jp.go.soumu.mkpf.mkpfmypage | grep versionName