CVE-2026-13514

Chess Play and Learn App com.chess AndroidManifest.xml backup

State: Published
Severity: 2.4 Low
Published: Jun 28, 2026
Updated: Jun 29, 2026
Reserved: Jun 28, 2026

Description

A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher.

Scores

CVSS	Score	Vector	Source
4.0	2.4 Low	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	2.4 Low	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
3.0	2.4 Low	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
2.0	2.1 Low	AV:L/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-530 Exposure of Backup File to an Unauthorized Control Sphere
CWE-285 Improper Authorization

Affected Products

Product	Versions
Play and Learn AppChess	4.9.0Affected 4.9.1Affected 4.9.2Affected 4.9.3Affected 4.9.4Affected 4.9.5Affected 4.9.6Affected 4.9.7Affected 4.9.8Affected 4.9.9Affected 4.9.10Affected 4.9.11Affected 4.9.12Affected 4.9.13Affected 4.9.14Affected 4.9.15Affected 4.9.16Affected 4.9.17Affected 4.9.18Affected 4.9.19Affected 4.9.20Affected 4.9.21Affected 4.9.22Affected 4.9.23Affected 4.9.24Affected and 18 more versions

References

VDB-374522 | Chess Play and Learn App com.chess AndroidManifest.xml backupvdb-entry
VDB-374522 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-13514 | CVE Analysis and Reportthird-party-advisory
Submit #838880 | Chess.com Chess - Play and Learn (Android) 4.9.42 Information Disclosurethird-party-advisory
https://github.com/honestcorrupt/CHESS.COM-CVE-REQUESTexploit
https://play.google.com/store/apps/details?id=com.chesspatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.