CVE-2026-77875: Calculator Vault Auth Bypass Vulnerability

CVE-2026-77875 Overview

CVE-2026-77875 affects a calculator-style vault Android application that hides media files behind a passcode-protected interface. The application enforces access control at the user interface layer but stores its SQLite database and media files in shared external storage without cryptographic protection. A local actor with read access to external storage can copy the vault contents without knowing the passcode. This weakness maps to [CWE-922: Insecure Storage of Sensitive Information]. The flaw was reported through a Fluid Attacks security advisory and impacts the com.macymind.calculatorlock application distributed on Google Play.

Critical Impact
Local attackers with shared external storage access can exfiltrate hidden media and database contents without authenticating to the vault, defeating the application's primary security guarantee.

Affected Products

Calculator Vault Android application (com.macymind.calculatorlock)
Versions distributed through Google Play at the time of disclosure
Android devices where the app stores data on shared external storage

Discovery Timeline

2026-09-19 - CVE-2026-77875 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77875

Vulnerability Analysis

The application presents users with a calculator interface that unlocks a hidden vault when the correct passcode is entered. This authentication boundary controls only the in-app view of stored content. The underlying SQLite database and associated media files reside on shared external storage without encryption or per-file access controls. Any process that can read shared external storage can enumerate and copy these files directly, bypassing the passcode check entirely. The vulnerability is classified under [CWE-922], reflecting a failure to bind sensitive data to an appropriate trust boundary.

Root Cause

The root cause is a design flaw. The application treats the passcode as an interface gate rather than a cryptographic key. Stored data is neither encrypted at rest nor placed in application-private storage. Because Android shared external storage is accessible to other apps holding relevant storage permissions and to any local shell with sufficient access, the confidentiality guarantee promised by the vault is not enforced at the storage layer.

Attack Vector

Exploitation requires local access to the device. An actor with an authorized non-root Android Debug Bridge (ADB) shell, a companion application holding storage read permissions, or another local file-reading context can locate the vault directory on shared external storage. The attacker copies the SQLite database and media files off the device using standard file transfer tools. No passcode entry, root privileges, or user interaction are required after storage access is obtained. Reference the Fluid Attacks Security Advisory for advisory details and the Google Play App Details for product context.

Detection Methods for CVE-2026-77875

Indicators of Compromise

Unexpected adb pull operations targeting the application's directory on shared external storage.
Presence of copies of .db or media files from the vault directory in unrelated locations on the device or in backups.
Third-party applications on the device holding broad READ_EXTERNAL_STORAGE or MANAGE_EXTERNAL_STORAGE permissions without clear justification.

Detection Strategies

Inventory installed Android applications and flag calculator vault or media-hiding apps that store data on shared external storage.
Monitor ADB session establishment on managed mobile devices, especially sessions that access application data directories.
Review mobile device management (MDM) logs for USB debugging enablement on user devices.

Monitoring Recommendations

Enable MDM alerts for developer options and USB debugging changes on enrolled devices.
Track applications requesting broad external storage permissions and correlate with data-hiding functionality.
Audit shared external storage access patterns where mobile threat defense telemetry is available.

How to Mitigate CVE-2026-77875

Immediate Actions Required

Remove or disable the affected calculator vault application on managed Android devices until a fixed version is published.
Do not store sensitive personal or corporate content in applications that persist data to shared external storage.
Disable USB debugging and revoke previously authorized ADB host keys on user devices.

Patch Information

No vendor advisory or patched version is referenced in the NVD entry at the time of publication. Monitor the Fluid Attacks Security Advisory and the Google Play App Details page for updates. Users should uninstall the application until the vendor confirms a fix that encrypts stored content and moves it into application-private storage.

Workarounds

Move sensitive media to applications that use Android's application-private storage combined with authenticated encryption.
Restrict which third-party applications receive READ_EXTERNAL_STORAGE or MANAGE_EXTERNAL_STORAGE permissions.
Enforce device-level full-disk encryption and a strong screen lock to limit offline data extraction from lost or stolen devices.

bash

# Configuration example: uninstall the affected package and revoke ADB authorizations
adb uninstall com.macymind.calculatorlock
adb shell settings put global adb_enabled 0
# On the device: Settings > Developer options > Revoke USB debugging authorizations