EUVD-2026-117514

ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke...

CVE-2026-106716

ReelShort for Android version 3.8.55 is vulnerable to a security flaw where it loads an attacker-controlled activityUrl via the cmsvictor://open deep link. The application fails to validate the page origin within a WebView , exposing the Android and Offerwall JavaScript bridges . An attacker can ...

Vulnerability in TikTok Android app could lead to one-click account hijacking

Microsoft discovered a high-severity vulnerability in the TikTok Android application, which could have allowed attackers to compromise users’ accounts with a single click. The vulnerability, which would have required several issues to be chained together to exploit, has been fixed and we did not...