Information from Newphoria Corporation
Title:Photon vulnerable to URL whitelist bypass
This is a statement from the vendor itself with no modification by JPCERT/CC.
Vulnerability in access restriction of Photon has been found.
Android Photon application up to version 1.1
Photon could be loaded using URL scheme with the possibility to open an arbitrary page.
In Android application it is possible to call API's on behalf of the affected application.
Update to the latest version.
Update to version 1.2 from GooglePlay
This vulnerability report was sent according to Information Security Early Warning partnership within regulation between our company and IPA with JPCERT/CC.
The information regarding the vulnerability was reported to us by Sprout Inc.
Our special thanks to Kenta Suefusa and Tomonori Shiomi of Sprout Inc., and also to anyone involved into Information Security Early Warning partnership.