Eddyverbruggen Cordova-Plugin-X-Socialsharing
CVE-2025-65835
The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses Intent.EXTRA_CHOSEN_COMPONENT without checking for null. If a broadcast is sent with extras present but without EXTRA_CHOSEN_COMPONENT, the code dereferences a null value and throws a NullPointerException. Because the receiver is exported and performs no permission or caller validation, any local application on the device can send crafted ACTION_SEND broadcasts to this component and repeatedly crash the host application, resulting in a local, unauthenticated application-level denial of service for any app that includes the plugin.
What this means for your business
- It affects Eddyverbruggen Cordova-Plugin-X-Socialsharing. It matters if your company, or a supplier that handles your data, runs it.
- Code showing how to exploit it has been published, but real attacks have not been confirmed.
- An attacker can use it only with access to the machine itself, without a login, and without anyone at your company clicking anything.
What to do
- 1Check whether your company or your suppliers run Eddyverbruggen Cordova-Plugin-X-Socialsharing, and which version. The affected versions are listed further down this page.
- 2If you do, follow the vendor's guidance. No patch reference has been published yet.
Not sure if your company is exposed?
Fastnexa’s certified penetration testers can check whether attackers could use this flaw, or others like it, against your websites, apps and network. The full test is free for our first 10 founding clients until 31 December 2026.
Scoring
- CVSS
- 6.2 (v3.1)
- Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness
- CWE-476
- Assigned by
- cve@mitre.org
Dates
- Published
- 2025-12-15
- Last modified
- 2026-09-15
- Sources
- NVD
Affected products
- Eddyverbruggen Cordova-Plugin-X-Socialsharing6.0.4
- Google Androidall versions
As listed in the NVD configuration data. Not a statement about your estate.