important · Mobile
A permissionless Android app can silently redirect OsmAnd requests and disclose a user's locations.
Affects
OsmAnd for Android, a navigation and offline-mapping application
Crafted intent extras silently replace map-tile or routing endpoints, sending viewed coordinates and route origins and destinations to an attacker-controlled service.
Detail and 2 sources
The current upstream manifest still exports the activity, but exact affected and fixed releases remain unknown.