CVE-2026-106716

A flaw was found in ReelShort. A remote attacker could obtain sensitive user metadata and credentials by tricking a user into opening a crafted deep link. The application renders attacker-supplied web addresses in an internal web browser view without properly validating the origin, permitting...

EUVD-2026-117514

ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke...

CVE-2026-106716

ReelShort for Android version 3.8.55 is vulnerable to a security flaw where it loads an attacker-controlled activityUrl via the cmsvictor://open deep link. The application fails to validate the page origin within a WebView , exposing the Android and Offerwall JavaScript bridges . An attacker can ...