EUVD-2026-117514

ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke...

CVE-2026-106716

ReelShort for Android version 3.8.55 is vulnerable to a security flaw where it loads an attacker-controlled activityUrl via the cmsvictor://open deep link. The application fails to validate the page origin within a WebView , exposing the Android and Offerwall JavaScript bridges . An attacker can ...