CVE-2026-13514
Full vulnerability record from the local CVENow database.
Description
A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher.
Severity
LOW
CVSS score
0.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-06-29 00:16:47.280000
Last modified
2026-10-25 17:10:00.197000
View original CVE JSON
{
"id": "CVE-2026-13514",
"sourceIdentifier": "[email protected]",
"published": "2026-06-29T00:16:47.280",
"lastModified": "2026-10-25T17:10:00.197",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty \"explicitly excludes physical-access attacks\". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher."
},
{
"lang": "es",
"value": "Se ha identificado una debilidad en la aplicación Chess Play and Learn hasta la versión 4.9.42 en Android. Este problema afecta a algún procesamiento desconocido del archivo AndroidManifest.xml del componente com.chess. Esta manipulación causa la exposición del archivo de copia de seguridad a una esfera de control no autorizada. Es factible realizar el ataque en el dispositivo físico. El exploit se ha puesto a disposición del público y podría usarse para ataques. Se aconseja actualizar el componente afectado. El proveedor fue informado con antelación sobre este problema. Confirmaron la existencia y que lo abordarán. Además, explican que su programa de recompensas por errores ’excluye explícitamente los ataques de acceso físico’. Sin embargo, aprecian la calidad del informe y tienen como objetivo realizar un pago de buena voluntad al investigador."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Chess",
"product": "Play and Learn App",
"cpes": [
"cpe:2.3:a:chess:play_and_learn_app:*:*:*:*:*:*:*:*"
],
"modules": [
"com.chess"
],
"versions": [
{
"version": "4.9.0",
"status": "affected"
},
{
"version": "4.9.1",
"status": "affected"
},
{
"version": "4.9.2",
"status": "affected"
},
{
"version": "4.9.3",
"status": "affected"
},
{
"version": "4.9.4",
"status": "affected"
},
{
"version": "4.9.5",
"status": "affected"
},
{
"version": "4.9.6",
"status": "affected"
},
{
"version": "4.9.7",
"status": "affected"
},
{
"version": "4.9.8",
"status": "affected"
},
{
"version": "4.9.9",
"status": "affected"
},
{
"version": "4.9.10",
"status": "affected"
},
{
"version": "4.9.11",
"status": "affected"
},
{
"version": "4.9.12",
"status": "affected"
},
{
"version": "4.9.13",
"status": "affected"
},
{
"version": "4.9.14",
"status": "affected"
},
{
"version": "4.9.15",
"status": "affected"
},
{
"version": "4.9.16",
"status": "affected"
},
{
"version": "4.9.17",
"status": "affected"
},
{
"version": "4.9.18",
"status": "affected"
},
{
"version": "4.9.19",
"status": "affected"
},
{
"version": "4.9.20",
"status": "affected"
},
{
"version": "4.9.21",
"status": "affected"
},
{
"version": "4.9.22",
"status": "affected"
},
{
"version": "4.9.23",
"status": "affected"
},
{
"version": "4.9.24",
"status": "affected"
},
{
"version": "4.9.25",
"status": "affected"
},
{
"version": "4.9.26",
"status": "affected"
},
{
"version": "4.9.27",
"status": "affected"
},
{
"version": "4.9.28",
"status": "affected"
},
{
"version": "4.9.29",
"status": "affected"
},
{
"version": "4.9.30",
"status": "affected"
},
{
"version": "4.9.31",
"status": "affected"
},
{
"version": "4.9.32",
"status": "affected"
},
{
"version": "4.9.33",
"status": "affected"
},
{
"version": "4.9.34",
"status": "affected"
},
{
"version": "4.9.35",
"status": "affected"
},
{
"version": "4.9.36",
"status": "affected"
},
{
"version": "4.9.37",
"status": "affected"
},
{
"version": "4.9.38",
"status": "affected"
},
{
"version": "4.9.39",
"status": "affected"
},
{
"version": "4.9.40",
"status": "affected"
},
{
"version": "4.9.41",
"status": "affected"
},
{
"version": "4.9.42",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 0.9,
"baseSeverity": "LOW",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 2.4,
"baseSeverity": "LOW",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 0.9,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"baseScore": 2.1,
"accessVector": "LOCAL",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-29T13:40:29.246622Z",
"id": "CVE-2026-13514",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-285"
},
{
"lang": "en",
"value": "CWE-530"
}
]
}
],
"references": [
{
"url": "https://github.com/honestcorrupt/CHESS.COM-CVE-REQUEST",
"source": "[email protected]"
},
{
"url": "https://play.google.com/store/apps/details?id=com.chess",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-13514",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/838880",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/374522",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/374522/cti",
"source": "[email protected]"
}
]
}