# GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)

> GitHub Security Lab reported that its open-source AI audit taskflows (seclab-taskflow-agent) found 24 vulnerabilities in Android apps. The detailed cases are OsmAnd (>10M downloads), where an exported MapActivity lets any installed app silently import settings and track location, and the Wikipedia Android app, where an endsWith() hostname check in deeplink and cookie handling enables cross-Wikimedia session theft and account takeover from a single tapped link.

- **Published:** 2026-11-13T10:30:54Z
- **Last reviewed:** 2026-11-13T10:30:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5953
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5953.png
- **ID:** TL-2026-5953
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (2 shown free below)
- **CVEs:** CVE-2026-65993, CVE-2026-65994, CVE-2026-65995, CVE-2026-65996, CVE-2026-65997

## Description

On 2026-09-28 Kevin Stubbings of GitHub Security Lab published results of auditing Android applications with the open-source GitHub Security Lab Taskflow Agent (seclab-taskflow-agent, MIT licence, Python, MCP-enabled, YAML-defined taskflows) and the seclab-taskflows audit set. Mobile-specific additions were gather_mobile_entry_point_info.yaml (separating mobile from non-mobile entry points) and an edited classify_application_local.yaml that forces per-entry-point checks for vulnerability classes such as confused deputy and insecure broadcasts. The author combined a strict prompt run repeatedly with a broader open prompt. The post says 24 vulnerabilities were reported at the time of writing (secondary coverage says 'more than 20'); a handful are critical, and common classes include path traversal, cross-app scripting in WebViews and exposed JavaScript bridges. Only OsmAnd and Wikipedia are named in the article.

OsmAnd (Android, >10M downloads): the activity MapActivity is exported and handles settings-file imports and in-app deeplinks. handleOsmAndSettingsImport reads the intent extras settings_version, silent_import, replace and export_type_list_key, which were meant to arrive only through an in-process AIDL service. Any app can attach these extras to an intent for an exported activity, so a malicious app with no permissions can silently import and replace settings without user confirmation. By overwriting the tile URL template to an attacker-controlled domain, the attacker receives the x/y coordinates of every map tile the user loads, and the same primitive exposes route origin and destination, with no visible change to the user. The Security Lab advisory index lists three OsmAnd advisories: GHSL-2026-106 (malicious deep links enable arbitrary file writes, CVE-2026-65996), GHSL-2026-108 (local apps can silently import malicious settings, CVE-2026-65997) and GHSL-2026-109 (local apps can steal location data and write files, CVE-2026-65995).

Wikipedia Android app: the handler for wikipedia:// deeplinks (handleIntent) validates the host with endsWith() against the base domain, so look-alike hosts (e.g. evil-wikipedia.org, per secondary coverage) pass and are forwarded to PageActivity, loading attacker content in the WebView while appearing to be Wikipedia and allowing JavaScript execution there. SharedPreferenceCookieManager.kt (about line 101) uses the same endsWith pattern to decide which cookies to send, so the victim's cookies go to the attacker page. The attacker obtains the username, a long-lived token and a session token valid across Wikimedia projects (Wikipedia, Commons, Wikidata, Meta), giving account takeover after one tapped link and with no permissions. Advisories: GHSL-2026-101 (malicious deep links can steal session cookies, CVE-2026-65993) and GHSL-2026-103 (local apps can hijack WebViews and steal session cookies, CVE-2026-65994), both dated 2026-10-01.

The article does not state in-the-wild exploitation, fix versions, CVSS scores or CWE identifiers, and published no PoC code (LLM-generated PoCs were used internally). NVD returned no records for the CVEs at research time. The author cautions that the model over-reports low-severity issues, overestimates severity when mitigations are missed (for example path traversal confined to external storage) and produces false positives, so every finding needs review by a mobile-security researcher. Severity here is analyst-assigned (MEDIUM, no CVSS in the sources); CWE mappings are analyst-derived from the described root causes.

## MITRE ATT&CK

- T1204.001 User Execution: Malicious Link
- T1539 Steal Web Session Cookie
- T1635.001 Steal Application Access Token: URI Hijacking
- T1430 Location Tracking
- T1533 Data from Local System
- T1660 Phishing
- T1641 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Wikipedia Android Look-alike Host Request (endsWith Bypass) — Exploitation** (`TL-2026-5953-SPL-001`)

Detects web-proxy requests to hostnames where a Wikimedia base domain (wikipedia.org, wikimedia.org, wikidata.org, mediawiki.org) is glued onto another label without a dot separator, e.g. evil-wikipedia.org. The Wikipedia Android deeplink handler (handleIntent) and SharedPreferenceCookieManager.kt validate hosts with endsWith(), so such hosts pass, load in the PageActivity WebView and receive the user's session cookies (CVE-2026-65993, GHSL-2026-101). Behaviour-first: no reliance on a specific domain IOC (evil-wikipedia.org is only an illustrative example). Maps to T1635.001, T1204.001, T1660 and T1189. Research states no in-the-wild exploitation; this is a vulnerability-exposure detection.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1635.001, T1204.001, T1660, T1189
- **Data sources:** Splunk CIM Web data model (web proxy logs), CommonSecurityLog (proxy via CEF), sigma logsource category proxy
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
| tstats summariesonly=true count min(_time) as firstTime max(_time) as lastTime values(Web.http_user_agent) as user_agent from datamodel=Web.Web by Web.src Web.url
| rename Web.* as *
| eval req_host=lower(replace(url, "^(?:https?://)?([^/:?#]+).*$", "\1"))
```Suffix-glued Wikimedia hostname: the endsWith() bypass in Wikipedia deeplink and cookie handling (CVE-2026-65993)```
| where match(req_host, "[^.](wikipedia|wikimedia|wikidata|mediawiki)[.]org$")
| eval firstTime=strftime(firstTime, "%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime, "%Y-%m-%d %H:%M:%S")
| table firstTime lastTime src req_host url user_agent count
````

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL) or isnotempty(DestinationHostName)
| extend ReqHost = tolower(iff(isnotempty(DestinationHostName), DestinationHostName, extract(@'^(?:https?://)?([^/:?#]+)', 1, RequestURL)))
// Suffix-glued Wikimedia hostname: endsWith() bypass in Wikipedia deeplink handling (CVE-2026-65993)
| where ReqHost matches regex @'[^.](wikipedia|wikimedia|wikidata|mediawiki)[.]org$'
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Requests=count(), SampleUrls=make_set(RequestURL, 5) by SourceIP, ReqHost
| project FirstSeen, LastSeen, SourceIP, ReqHost, Requests, SampleUrls
```

### Sigma

```yaml
title: Wikimedia Look-alike Host Request - Android endsWith Hostname Bypass
id: 5b1f3c7e-4a92-4d6b-8e0a-1c7d2f9a6b31
status: experimental
description: Detects proxy requests to hostnames that end in a Wikimedia base domain without a dot boundary (e.g. evil-wikipedia.org). The Wikipedia Android app validated deeplink and cookie hosts with endsWith(), so such hosts load in the app WebView and receive session cookies (CVE-2026-65993, GHSL-2026-101).
references:
  - https://securitylab.github.com/ai-agents/
  - https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/
author: Threadlinqs Team
date: 2026/11/13
tags:
  - attack.initial-access
  - attack.t1660
  - attack.t1189
  - attack.execution
  - attack.t1204.001
  - attack.credential-access
  - attack.t1635.001
  - cve.2026-65993
logsource:
  category: proxy
detection:
  selection:
    cs-host|re: '[^.](wikipedia|wikimedia|wikidata|mediawiki)[.]org$'
  condition: selection
falsepositives:
  - Unrelated third-party domains that happen to end in wikipedia.org, wikimedia.org, wikidata.org or mediawiki.org without a dot boundary
  - Security awareness or phishing-simulation exercises using look-alike domains
level: medium
```

**Known false positives:**

- Legitimate third-party domains that happen to end in a Wikimedia base domain with no dot separator
- Phishing-simulation or red-team exercises that register look-alike Wikimedia domains

**Tuning notes:** Requires web proxy or secure web gateway logs for mobile or Wi-Fi/VPN-routed traffic mapped to the CIM Web data model. Add confirmed-benign look-alike domains to an exclusion lookup. Raise priority when the same src also sends Wikimedia session cookies to the host (see TL-2026-5953-SPL-003). Mobile traffic off the corporate network will not be visible.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- DNS Resolution of Wikimedia Look-alike Domain (Deeplink Hijack Precursor) — Exploitation (locked: unlock with TL Creds)
- OsmAnd First-Seen Tile Host Not Previously Contacted (Tile URL Template Overwrite) — Post-Exploitation (locked: unlock with TL Creds)
- Wikimedia Session Cookies Sent to Look-alike Host (endsWith Cookie Scoping) — Exfiltration (locked: unlock with TL Creds)
- Wikipedia App Traffic to Non-Wikimedia Host (WebView Loaded Attacker Page) — Exploitation (locked: unlock with TL Creds)
- OsmAnd Map-Tile Request to Non-OSM Host (Silent Settings Import) — Post-Exploitation (locked: unlock with TL Creds)
- Wikimedia Long-Lived Token Cookie Sent to Non-Wikimedia Host (Account Takeover) — Exfiltration (locked: unlock with TL Creds)
- OsmAnd Tile Requests Redirected to Non-OSM Host (Settings Import Hijack) — Post-Exploitation (locked: unlock with TL Creds)
- Wikimedia Session Cookies Sent to Non-Wikimedia Host (Cookie Theft) — Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 11)

Defanged, TLP:CLEAR.

- Domain: `evil-wikipedia[.]org`
- URL: `hxxps://securitylab[.]github[.]com/ai-agents/`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [How we found 24 Android vulnerabilities using our open source AI security agent (GitHub Security Lab)](https://github.blog/security/how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent/)
- [GitHub Security Lab - AI agents advisories](https://securitylab.github.com/ai-agents/)
- [seclab-taskflow-agent (GitHub Security Lab)](https://github.com/GitHubSecurityLab/seclab-taskflow-agent)
- [Help Net Security - GitHub's AI agent found 24 Android app vulnerabilities](https://www.helpnetsecurity.com/2026/09/29/github-ai-android-app-vulnerabilities/)
- [GBHackers - GitHub AI agent uncovers 24 Android app vulnerabilities](https://gbhackers.com/github-ai-agent-uncovers-24-android-app-vulnerabilities/amp/)
- [GitHub Security Lab - Community-powered security with AI: an open source framework for security research](https://github.blog/security/community-powered-security-with-ai-an-open-source-framework-for-security-research/)
- [GitHub Security Lab - How to scan for vulnerabilities with the open source AI-powered framework](https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/)
- [Android Developers - Intent reference](https://developer.android.com/reference/android/content/Intent)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5953