CVE-2025-65820

Technical Details

The vulnerability stems from an improperly secured exported activity within the Meatmeet Android application. Exported activities are components of an Android application that can be invoked by other applications or even through ADB (Android Debug Bridge) commands. In this case, a specific exported activity, intended for internal use or future features, was not adequately protected. By crafting a specific intent, an attacker can launch this activity, bypassing the normal application flow and accessing a hidden page. This hidden page displays a list of devices that can be added to a user's account. Critically, this list includes devices that have not yet been publicly released. This information disclosure allows an attacker to gain insight into Meatmeet's product roadmap and potentially exploit vulnerabilities in these unreleased devices before they are even available to the public. The lack of proper access controls on this exported activity is the root cause of the vulnerability.

The exploitation requires no user interaction beyond installing the application. An attacker can use ADB or create a malicious application to send the crafted intent to the vulnerable activity. The application does not properly validate the caller or the intent, resulting in the information disclosure.