The vulnerability resides in the handler for a custom URL scheme in GEO CORPORATION’s "ゲオアプリ". Improper authorization allows an attacker to open an arbitrary web page within the app’s in‑app browser, potentially enabling phishing attacks or the disclosure of a service’s session ID. This weakness is classified as CWE‑939, meaning a malicious actor can gain access to resources beyond what the application intends.

Both the Android and iOS versions of "ゲオアプリ" distributed by GEO CORPORATION are affected. No specific version numbers are listed, so all builds released prior to an official remedy should be considered vulnerable until a vendor fix is issued.

The CVSS base score is 5.1, indicating a moderate impact. The EPSS score is below 1 %, signifying a low probability of exploitation as of the latest data. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is social engineering where an attacker convinces a user to trigger the vulnerable custom URL scheme, for example by luring them to click a malicious link or button. Successful exploitation could result in phishing or session hijacking rather than direct code execution.