CVE-2026-84442 Overview
CVE-2026-84442 is a path traversal vulnerability [CWE-22] in the MapQuest Get Directions App version 10.16.1 for Android. The flaw resides in the getDataColumn function of the ExpoShareIntentModule.kt file within the com.mapquest.android.ace component. Improper handling of file path input allows a local attacker with low privileges to traverse directories outside the intended scope. The exploit has been publicly disclosed. According to the disclosure, the vendor was contacted early but did not respond.
Critical Impact
Local attackers can leverage improper path handling in the share intent module to reference files outside the intended directory scope, resulting in limited integrity and availability impact on the Android device.
Affected Products
- MapQuest Get Directions App 10.16.1 for Android
- Component: com.mapquest.android.ace
- File: ExpoShareIntentModule.kt
Discovery Timeline
- 2026-09-02 - CVE-2026-84442 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84442
Vulnerability Analysis
The vulnerability affects how the MapQuest Get Directions Android app resolves file paths inside its share-intent handling module. The getDataColumn function in ExpoShareIntentModule.kt accepts input used to resolve a content URI to a real file path. Because the input is not properly canonicalized or validated, an attacker can supply path segments containing traversal sequences to reference locations outside the expected directory. Exploitation requires local access to the device and low privileges, limiting the scope to attackers who can invoke the vulnerable share-intent surface.
Root Cause
The root cause is missing or insufficient input validation in the getDataColumn function. The function trusts caller-supplied path data during the URI-to-file translation without normalizing traversal sequences such as ../. This classifies the issue as a path traversal weakness under [CWE-22].
Attack Vector
An attacker must have local access to the Android device, typically through a co-resident malicious application that can send crafted share intents to com.mapquest.android.ace. By supplying a manipulated data column value, the attacker causes the module to resolve paths outside the app's sandbox boundary. Because user interaction is not required, another installed application on the same device can trigger the flaw programmatically.
No verified public exploit code has been provided in the enrichment data. Technical details are documented in the VulDB CVE-2026-84442 entry and the VulDB Vulnerability #397830 record.
Detection Methods for CVE-2026-84442
Indicators of Compromise
- Presence of MapQuest Get Directions App version 10.16.1 on managed Android devices.
- Share intents directed at com.mapquest.android.ace containing path traversal sequences such as ../ in content URI data columns.
- Unexpected file access by the MapQuest process outside its private application directory.
Detection Strategies
- Inventory Android endpoints and flag installations of MapQuest Get Directions 10.16.1.
- Monitor mobile telemetry for inter-process intent traffic targeting com.mapquest.android.ace with suspicious URI payloads.
- Review logcat traces for file access errors originating from ExpoShareIntentModule referencing paths outside the app sandbox.
Monitoring Recommendations
- Enable MDM policy alerts for installations of vulnerable MapQuest versions on corporate-managed devices.
- Correlate mobile threat defense logs with process-level file access events to catch attempted traversal.
- Track vendor advisory channels and the VulDB Submission #885452 record for updates and patch availability.
How to Mitigate CVE-2026-84442
Immediate Actions Required
- Restrict installation of MapQuest Get Directions 10.16.1 on managed Android fleets until a fixed release is available.
- Advise users to remove or disable the affected app on high-sensitivity devices.
- Audit installed third-party apps that can send share intents to com.mapquest.android.ace.
Patch Information
No vendor patch has been published in the enrichment data. According to the disclosure, the vendor did not respond to outreach. Track the VulDB CVE-2026-84442 entry and the vendor's Play Store listing for future updates.
Workarounds
- Uninstall MapQuest Get Directions 10.16.1 from Android devices handling sensitive data.
- Enforce MDM policies that block sideloading and unvetted app installations to reduce local attacker presence.
- Use Android work profile isolation to prevent cross-app intent abuse against the vulnerable component.
# Example MDM inventory query to flag vulnerable installations
adb shell pm list packages --show-versioncode | grep com.mapquest.android.ace
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.