An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL. The app can be tricked into automatically opening a link that may lead to phishing sites, credential theft, or the delivery of malware. This not only exposes the user to potential data compromise but could also trigger the execution of malicious code downloaded from the crafted URL.

The vulnerability affects the FeedEx / Handy News Reader mobile application, specifically the release identified by versionCode 116. No other versions or products are listed.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly reported exploitation to date. However, the nature of the flaw—automatically fetching a crafted URL—could enable attackers to deliver phishing or malware content to unsuspecting users. The attack vector is local client-side; an attacker must influence the victim’s device or provide a malicious link that the application will unknowingly process. The absence of an official patch or workaround suggests that the risk remains until a fixed version is released. Users should monitor for updates and consider disabling or uninstalling the affected app if a fix is not yet available.