CVE-2025-68713

The record

An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's trusted Received interface. These conditions establish a vector for arbitrary code execution if the payload is an APK file, or a denial-of-service condition through resource exhaustion from oversized transfers.

Affected packages

Related vulnerabilities

• CVE-2026-18994 A potential improper authorization vulnerability was reported in the Lenovo File Manager… CWE-926
• CVE-2026-21081 Improper export of android application components in SamsungPassAutofill prior to version… CWE-926
• CVE-2026-21063 Improper export of android application components in AppLock prior to SMR Aug-2026… CWE-926
• CVE-2026-21059 Improper export of android application components in Samsung Contacts prior to SMR… CWE-926
• CVE-2026-47363 In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher… CWE-926
• CVE-2026-47361 In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is… CWE-926
• CVE-2026-44965 In versions of the Datadog Android application prior to v545-5.9.2, six App Widget… CWE-926
• CVE-2026-20470 In Telephony, there is a possible information disclosure due to a missing permission… CWE-926