GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5953 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Wikipedia Android Look-alike Host Request (endsWith Bypass) — Exploitation

Detects web-proxy requests to hostnames where a Wikimedia base domain (wikipedia.org, wikimedia.org, wikidata.org, mediawiki.org) is glued onto another label without a dot separator, e.g. evil-wikipedia.org. The Wikipedia Android deeplink handler (handleIntent) and SharedPreferenceCookieManager.kt validate hosts with endsWith(), so such hosts pass, load in the PageActivity WebView and receive the user's session cookies (CVE-2026-65993, GHSL-2026-101). Behaviour-first: no reliance on a specific domain IOC (evil-wikipedia.org is only an illustrative example). Maps to T1635.001, T1204.001, T1660 and T1189. Research states no in-the-wild exploitation; this is a vulnerability-exposure detection.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1635.001, T1204.001, T1660, T1189
• Data sources: Splunk CIM Web data model (web proxy logs), CommonSecurityLog (proxy via CEF), sigma logsource category proxy
• Severity: medium
• Confidence: medium

Splunk SPL

| tstats summariesonly=true count min(_time) as firstTime max(_time) as lastTime values(Web.http_user_agent) as user_agent from datamodel=Web.Web by Web.src Web.url
| rename Web.* as *
| eval req_host=lower(replace(url, "^(?:https?://)?([^/:?#]+).*$", "\1"))
```Suffix-glued Wikimedia hostname: the endsWith() bypass in Wikipedia deeplink and cookie handling (CVE-2026-65993)```
| where match(req_host, "[^.](wikipedia|wikimedia|wikidata|mediawiki)[.]org$")
| eval firstTime=strftime(firstTime, "%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime, "%Y-%m-%d %H:%M:%S")
| table firstTime lastTime src req_host url user_agent count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL) or isnotempty(DestinationHostName)
| extend ReqHost = tolower(iff(isnotempty(DestinationHostName), DestinationHostName, extract(@'^(?:https?://)?([^/:?#]+)', 1, RequestURL)))
// Suffix-glued Wikimedia hostname: endsWith() bypass in Wikipedia deeplink handling (CVE-2026-65993)
| where ReqHost matches regex @'[^.](wikipedia|wikimedia|wikidata|mediawiki)[.]org$'
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Requests=count(), SampleUrls=make_set(RequestURL, 5) by SourceIP, ReqHost
| project FirstSeen, LastSeen, SourceIP, ReqHost, Requests, SampleUrls

Sigma

title: Wikimedia Look-alike Host Request - Android endsWith Hostname Bypass
id: 5b1f3c7e-4a92-4d6b-8e0a-1c7d2f9a6b31
status: experimental
description: Detects proxy requests to hostnames that end in a Wikimedia base domain without a dot boundary (e.g. evil-wikipedia.org). The Wikipedia Android app validated deeplink and cookie hosts with endsWith(), so such hosts load in the app WebView and receive session cookies (CVE-2026-65993, GHSL-2026-101).
references:
  - https://securitylab.github.com/ai-agents/
  - https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/
author: Threadlinqs Team
date: 2026/11/13
tags:
  - attack.initial-access
  - attack.t1660
  - attack.t1189
  - attack.execution
  - attack.t1204.001
  - attack.credential-access
  - attack.t1635.001
  - cve.2026-65993
logsource:
  category: proxy
detection:
  selection:
    cs-host|re: '[^.](wikipedia|wikimedia|wikidata|mediawiki)[.]org$'
  condition: selection
falsepositives:
  - Unrelated third-party domains that happen to end in wikipedia.org, wikimedia.org, wikidata.org or mediawiki.org without a dot boundary
  - Security awareness or phishing-simulation exercises using look-alike domains
level: medium

Known false positives:

• Legitimate third-party domains that happen to end in a Wikimedia base domain with no dot separator
• Phishing-simulation or red-team exercises that register look-alike Wikimedia domains

Tuning notes: Requires web proxy or secure web gateway logs for mobile or Wi-Fi/VPN-routed traffic mapped to the CIM Web data model. Add confirmed-benign look-alike domains to an exclusion lookup. Raise priority when the same src also sends Wikimedia session cookies to the host (see TL-2026-5953-SPL-003). Mobile traffic off the corporate network will not be visible.

• 🔒 DNS Resolution of Wikimedia Look-alike Domain (Deeplink Hijack Precursor) — Exploitation · unlock with TL Creds
• 🔒 OsmAnd First-Seen Tile Host Not Previously Contacted (Tile URL Template Overwrite) — Post-Exploitation · unlock with TL Creds
• 🔒 Wikimedia Session Cookies Sent to Look-alike Host (endsWith Cookie Scoping) — Exfiltration · unlock with TL Creds
• 🔒 Wikipedia App Traffic to Non-Wikimedia Host (WebView Loaded Attacker Page) — Exploitation · unlock with TL Creds
• 🔒 OsmAnd Map-Tile Request to Non-OSM Host (Silent Settings Import) — Post-Exploitation · unlock with TL Creds
• 🔒 Wikimedia Long-Lived Token Cookie Sent to Non-Wikimedia Host (Account Takeover) — Exfiltration · unlock with TL Creds
• 🔒 OsmAnd Tile Requests Redirected to Non-OSM Host (Settings Import Hijack) — Post-Exploitation · unlock with TL Creds
• 🔒 Wikimedia Session Cookies Sent to Non-Wikimedia Host (Cookie Theft) — Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5953.

Sample indicators (2 of 11)

• Domain: evil-wikipedia[.]org
• URL: hxxps://securitylab[.]github[.]com/ai-agents/

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Technical analysis

On 2026-09-28 Kevin Stubbings of GitHub Security Lab published results of auditing Android applications with the open-source GitHub Security Lab Taskflow Agent (seclab-taskflow-agent, MIT licence, Python, MCP-enabled, YAML-defined taskflows) and the seclab-taskflows audit set. Mobile-specific additions were gather_mobile_entry_point_info.yaml (separating mobile from non-mobile entry points) and an edited classify_application_local.yaml that forces per-entry-point checks for vulnerability classes such as confused deputy and insecure broadcasts. The author combined a strict prompt run repeatedly with a broader open prompt. The post says 24 vulnerabilities were reported at the time of writing (secondary coverage says 'more than 20'); a handful are critical, and common classes include path traversal, cross-app scripting in WebViews and exposed JavaScript bridges. Only OsmAnd and Wikipedia are named in the article.

OsmAnd (Android, >10M downloads): the activity MapActivity is exported and handles settings-file imports and in-app deeplinks. handleOsmAndSettingsImport reads the intent extras settings_version, silent_import, replace and export_type_list_key, which were meant to arrive only through an in-process AIDL service. Any app can attach these extras to an intent for an exported activity, so a malicious app with no permissions can silently import and replace settings without user confirmation. By overwriting the tile URL template to an attacker-controlled domain, the attacker receives the x/y coordinates of every map tile the user loads, and the same primitive exposes route origin and destination, with no visible change to the user. The Security Lab advisory index lists three OsmAnd advisories: GHSL-2026-106 (malicious deep links enable arbitrary file writes, CVE-2026-65996), GHSL-2026-108 (local apps can silently import malicious settings, CVE-2026-65997) and GHSL-2026-109 (local apps can steal location data and write files, CVE-2026-65995).

Wikipedia Android app: the handler for wikipedia:// deeplinks (handleIntent) validates the host with endsWith() against the base domain, so look-alike hosts (e.g. evil-wikipedia.org, per secondary coverage) pass and are forwarded to PageActivity, loading attacker content in the WebView while appearing to be Wikipedia and allowing JavaScript execution there. SharedPreferenceCookieManager.kt (about line 101) uses the same endsWith pattern to decide which cookies to send, so the victim's cookies go to the attacker page. The attacker obtains the username, a long-lived token and a session token valid across Wikimedia projects (Wikipedia, Commons, Wikidata, Meta), giving account takeover after one tapped link and with no permissions. Advisories: GHSL-2026-101 (malicious deep links can steal session cookies, CVE-2026-65993) and GHSL-2026-103 (local apps can hijack WebViews and steal session cookies, CVE-2026-65994), both dated 2026-10-01.

The article does not state in-the-wild exploitation, fix versions, CVSS scores or CWE identifiers, and published no PoC code (LLM-generated PoCs were used internally). NVD returned no records for the CVEs at research time. The author cautions that the model over-reports low-severity issues, overestimates severity when mitigations are missed (for example path traversal confined to external storage) and produces false positives, so every finding needs review by a mobile-security researcher. Severity here is analyst-assigned (MEDIUM, no CVSS in the sources); CWE mappings are analyst-derived from the described root causes.

MITRE ATT&CK techniques by tactic:

Execution

T1204.001 User Execution: Malicious Link

Collection

T1430 Location Tracking; T1533 Data from Local System

Credential Access

T1539 Steal Web Session Cookie; T1635.001 Steal Application Access Token: URI Hijacking

Impact

T1641 Data Manipulation

Initial Access

T1660 Phishing

Remediation

Patches

• Fixed versions not stated in the sources; check vendor release notes (OsmAnd, Wikimedia) and the Security Lab advisories

Immediate actions

• Update OsmAnd and the Wikipedia Android app to the latest store versions once the vendors' fixed releases are available; the sources do not state fix versions
• Review the GitHub Security Lab advisories GHSL-2026-101, -103, -106, -108 and -109 for vendor status
• On managed Android fleets, inventory installs of OsmAnd and the Wikipedia app and prioritise updates

Workarounds

• Avoid tapping untrusted links on devices with the vulnerable Wikipedia app; sign out of Wikimedia accounts in the app if exposure is suspected
• Restrict installation of untrusted apps on devices running vulnerable OsmAnd builds

Longer-term hardening

• Do not export Android components that do not need to be exported; set android:exported=false and enforce permissions on required ones
• Treat intent extras sent to exported activities as untrusted input and never gate security-relevant behaviour on extras meant for internal IPC
• Validate deeplink hosts with exact-match or allow-list comparison instead of endsWith() or suffix matching, in both navigation and cookie-scoping code
• Review every AI-generated finding with a mobile-security researcher before triage; use PoC generation or a debugger to cut false positives

Affected and fixed versions

• OsmAnd — OsmAnd (Android)
  Vulnerable versions: Versions not stated in sources
  Fixed in: Not stated in sources
• Wikimedia Foundation — Wikipedia Android app
  Vulnerable versions: Versions not stated in sources
  Fixed in: Not stated in sources

Timeline

• 2026-04-02 GHSL-2026-082 (Signal for Android) is the earliest advisory on the Security Lab AI-agents advisory page, which later lists the OsmAnd and Wikipedia Android findings
• 2026-09-28 GitHub Security Lab (Kevin Stubbings) publishes 'How we found 24 Android vulnerabilities using our open source AI security agent', detailing the OsmAnd and Wikipedia findings and the mobile taskflow additions
• 2026-09-29 Help Net Security and other outlets report the research; coverage notes 'more than 20' reported vulnerabilities and no CVE or fix details at that time
• 2026-10-01 Security Lab lists GHSL-2026-106 (CVE-2026-65996), GHSL-2026-108 (CVE-2026-65997) and GHSL-2026-109 (CVE-2026-65995) for OsmAnd: arbitrary file write, silent settings import and location theft
• 2026-10-01 Security Lab lists GHSL-2026-101 (CVE-2026-65993, deeplinks steal session cookies) and GHSL-2026-103 (CVE-2026-65994, local apps hijack WebViews and steal session cookies) for Wikipedia
• 2026-11-13 Research review: NVD returns no records for the CVEs yet; fix versions and in-the-wild exploitation are not stated in any source

Sources cited

• GitHub Security Lab - AI agents advisories GitHub · Advisory · 2026-10-01
• How we found 24 Android vulnerabilities using our open source AI security agent (GitHub Security Lab) github.blog · Research · 2026-09-28
• Android Developers - Intent reference developer.android.com · Vendor report
• seclab-taskflow-agent (GitHub Security Lab) GitHub · Code repository
• GitHub Security Lab - Community-powered security with AI: an open source framework for security research github.blog · Blog
• GitHub Security Lab - How to scan for vulnerabilities with the open source AI-powered framework github.blog · Blog
• Help Net Security - GitHub's AI agent found 24 Android app vulnerabilities Help Net Security · News · 2026-09-29
• GBHackers - GitHub AI agent uncovers 24 Android app vulnerabilities gbhackers.com · News · 2026-09-29

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)
• Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi