CVE-2026-85125: YAMAP GPS App Information Disclosure Flaw

CVE-2026-85125 Overview

CVE-2026-85125 is an improper access control vulnerability in the WebView implementation of the Android application YAMAP -Social Trekking GPS App. The in-app browser fails to properly restrict how loaded content interacts with the host application. Attackers can leverage the flaw to leak information from the app or redirect users to unintended websites. The weakness is categorized under CWE-940: Improper Verification of Source of a Communication Channel. Exploitation requires user interaction, typically by convincing a user to open a crafted link within the vulnerable in-app browser.

Critical Impact
A remote attacker can induce information leakage from the YAMAP Android app or redirect users to attacker-controlled destinations through the vulnerable in-app WebView.

Affected Products

YAMAP -Social Trekking GPS App for Android
Distributed via Google Play
See the JVN Vulnerability Report JVN69877538 for affected version details

Discovery Timeline

2026-09-14 - CVE-2026-85125 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85125

Vulnerability Analysis

The YAMAP Android application embeds a WebView component to render web content inside an in-app browser. WebView is a common Android component that renders HTML, CSS, and JavaScript inside a native application context. When applications do not properly validate the origins or targets loaded into WebView, hostile content can influence app behavior or navigation.

In this case, the in-app browser can be induced to load attacker-controlled or unintended URLs. Loaded content may access information exposed by the app or trigger navigation flows that mislead the user. The impact is limited to confidentiality and integrity of data reachable by the in-app browser context, and requires the user to interact with a crafted link.

Root Cause

The root cause is improper access control on the WebView-based in-app browser. The application does not sufficiently restrict which URLs, schemes, or origins can be loaded, nor does it enforce a strict boundary between untrusted web content and app-exposed interfaces. This aligns with [CWE-940], where the source of an incoming communication channel is not properly verified.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a link, message, or web page that, when opened by a YAMAP user, causes the in-app WebView to load hostile content. The hostile content can then exfiltrate information available to the browser context or redirect the victim to a phishing or credential-harvesting site. No prior authentication is required. Verified public exploit code is not available at the time of writing. See the Yamap Security Analysis for vendor detail.

Detection Methods for CVE-2026-85125

Indicators of Compromise

Outbound HTTP or HTTPS requests from Android devices to unexpected domains originating from the YAMAP application context.
User reports of the in-app browser opening unfamiliar login pages or displaying unexpected redirects.
Mobile telemetry showing WebView loads of URLs unrelated to YAMAP hosted services.

Detection Strategies

Monitor mobile DNS and proxy logs for anomalous domains reached shortly after opening links inside the YAMAP app.
Deploy mobile threat defense tooling to flag applications loading untrusted origins in embedded WebViews.
Correlate user-reported phishing incidents with mobile application usage timelines.

Monitoring Recommendations

Track installed YAMAP application versions across managed Android devices and flag those below the fixed release.
Alert on newly registered lookalike domains that could be used as redirect destinations for hikers and outdoor community users.
Review mobile device management logs for unusual link-handling patterns tied to the jp.co.yamap package.

How to Mitigate CVE-2026-85125

Immediate Actions Required

Update the YAMAP Android application to the latest version available on Google Play.
Instruct users to avoid opening untrusted links inside the YAMAP in-app browser until updates are confirmed.
Educate users to verify domains before entering credentials in any page loaded from the app.

Patch Information

Refer to the vendor advisory published at Yamap Security Analysis and the coordinated disclosure entry JVN69877538 for the fixed version and remediation guidance.

Workarounds

Open external links in the device's default browser rather than the in-app WebView when possible.
Restrict installation of outdated YAMAP versions through mobile device management policies.
Apply network-level blocking for known phishing infrastructure targeting outdoor and hiking application users.

bash

# Verify installed YAMAP package version via ADB
adb shell dumpsys package jp.co.yamap | grep versionName