CVE-2026-53407: Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7

Synopsis

An improper authorization flaw in the custom URL scheme handler affects Zoom Workplace for Android (before 7.0.4) and iOS (before 7.0.3). A remote attacker with a low-privilege account can reach the vulnerable handler over the network without any victim interaction, then escalate privileges to read sensitive data or tamper with application data. A patched-image rebuild at version 7.0.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the custom URL scheme handler over the network; the service must be exposed to an external or internal network-reachable surface.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed to trigger the handler.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed for the attacker to exploit this flaw.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• A successful attacker reads sensitive application data, which may include session tokens, user credentials, or private meeting content stored by Zoom Workplace.
• A successful attacker modifies application state or configuration data, enabling privilege escalation within the Zoom Workplace application context.
• Confidentiality and integrity of the affected device's Zoom session are both compromised, but availability of the service is not directly affected by this vulnerability.