The Chess Play and Learn App for Android, versions up to 4.9.42, contains a weakness that improperly processes the AndroidManifest.xml file for the com.chess component. This flaw permits a local attacker with physical access to the device to manipulate or read the app’s backup file, thereby exposing sensitive information to an unauthorized control sphere. The root cause is a broken access control (CWE‑285) coupled with an unnecessary open permission (CWE‑530).

The vulnerability affects the Chess:Play and Learn App on Android devices running version 4.9.42 or earlier. It originates in the com.chess component’s handling of the AndroidManifest.xml backup logic.

The CVSS score of 2.4 indicates a low score, and the EPSS score is not available, so the exploitation probability is not quantified. The attack vector requires physical access to the device, limiting the threat to local attackers. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation to date, but public exploit code has been released and the vendor has confirmed the issue and plans a fix. Overall, the risk is moderate: devices that can be physically accessed remain vulnerable until patched.