The vulnerability arises from a misuse of the Class.forName method within the ToggleGeneric.java file, allowing a local user to manipulate the argument and improperly export Android application components. This misconfiguration enables a local attacker to gain access to components that should be private, potentially leading to privilege escalation or unintended data exposure. The flaw is rooted in CWE-926, which highlights improper export of components.

LeeDrOiD Labs Shortcutter 2 App version 9.0.48 on Android is affected by this issue. The vendor has released an updated version, 9.0.90, that addresses the improper export of components. No other versions are listed as impacted.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available, suggesting low to moderate exploitation probability. The vulnerability requires local access, so an attacker must have physical or local device access to exploit it. The exploit has been publicly disclosed and is usable, but it does not provide remote code execution; it primarily allows unauthorized component access. The presence of a vendor‑released fix mitigates the risk, and updating to 9.0.90 is the recommended course of action.