Unauthorized Data Access in Oracle Financial Services Analytical Applications Infrastructure

This repository is a small proof-of-concept demonstrating Android intent redirection / permission bypass behavior associated with CVE-2026-22010. The core vulnerable logic appears twice in Java files (VulnActivity.java and duplicate VulnActivities.java): an exported Android Activity reads attacker-controlled extras 'pkg' and 'cls' from the incoming intent, builds a new Intent with setClassName(targetPkg, targetCls), copies all original extras with putExtras(...), and launches the chosen component via startActivity(...). This enables an attacker to redirect execution into an internal or protected activity if the app fails to validate the destination component. Repository structure is minimal: README.md explains the issue and gives an adb exploitation example; the two Java files simulate the vulnerable Android component; exploit_android_intent_redirect.py is not a functional exploit script and only prints a conceptual description. There is no network communication, no remote C2, and no automated payload delivery. The exploit capability is local to the Android device/emulator context and primarily demonstrates unauthorized launching of internal activities with attacker-controlled extras, which could lead to access to private functionality or data theft depending on the target app.