EUVD-2026-87230

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-18312 CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-18312

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) flaw in its WebView URL construction logic. The application fails to properly encode or escape attacker-controlled metadata before interpolating it into URL strings, specifically impacting the X (former...

Chromium CVE-2026-95285: Missing authorization in WebView

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-87522

A flaw was found in WebView in Google Chrome on Android. Missing authorization allows a remote attacker, by leveraging social engineering and crafted network traffic, to potentially bypass system access restrictions. This could lead to unauthorized access to sensitive system functions...

CVE-2026-79273

A flaw was found in WebView in Google Chrome on Android. Incorrect reference resolution could allow a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions within the...

CVE-2026-18312: Improper Neutralization of Input During Web Page Generation

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

PT-2026-98897

🚨 CVE-2026-18312 Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs...

PT-2026-98896

Name of the Vulnerable Software and Affected Versions Readwise Reader for Android versions prior to 8.7.3 Description Stored cross-site scripting XSS occurs due to missing HTML sanitization when processing imported document metadata. Specifically, attacker-controlled fields such as doc.author and...

CVE-2026-18320: Improper Neutralization of Input During Web Page Generation

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities

Overview Three cross-site scripting XSS vulnerabilities identified in Readwise Reader for Android version 8.7.2 are disclosed. An attacker with the ability to craft malicious documents or metadata can exploit these vulnerabilities by supplying poisoned content that bypasses sanitization. Successf...

SUSE CVE-2026-95285

Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-95285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

Canva Mobile App for HarmonyOS prior to v1.15.1 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . The underlying cause is an insufficient origin check on WebView responses, allowing a threat actor with control of the WebView to read a user's session ...

EUVD-2026-83843

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860: Improper Removal of Sensitive Information Before Storage or Transfer

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

PT-2026-96044

Name of the Vulnerable Software and Affected Versions Canva Mobile App for HarmonyOS versions prior to 1.15.1 Description The application fails to restrict headers returned to an external origin operating within a privileged WebView. A privileged WebView is a system component that allows the...