CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-18311 CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18311

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) vulnerability due to insufficient HTML escaping and missing sanitization in the header rendering component. Specifically, attacker-controlled metadata fields, such as doc.author and doc.title , are inse...

EUVD-2026-87232

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18311 CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18320

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) flaw in the article body sanitization component. The root cause is a sanitize-html configuration that uses a wildcard attribute rule, permitting all attributes on SVG and PATH elements. This allows scri...

EUVD-2026-87231

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

CVE-2026-18320 CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

CVE-2026-18312 CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-18312

Readwise Reader for Android version 8.7.2 is vulnerable to a stored cross-site scripting (XSS) flaw in its WebView URL construction logic. The application fails to properly encode or escape attacker-controlled metadata before interpolating it into URL strings, specifically impacting the X (former...

EUVD-2026-87230

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-79210

A flaw was found in the Audio component of Chromium, specifically in Google Chrome on Android. This use-after-free vulnerability allows a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to...

Exploit for CVE-2026-64560

CVE-2026-64560 – Toolchain + Multi-target Porting CVE-2026-64...

CVE-2026-79042

A flaw was found in Google Chrome on Android. Missing authorization in the Payments functionality allows a remote attacker, leveraging social engineering, to potentially bypass system access restrictions. This can be achieved by enticing a user to interact with a specially crafted HTML page...

CVE-2026-79124

A flaw was found in Google Chrome on Android. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak through the improper handling of Intents, allowing the attacker to access sensitive user information...

CVE-2026-79129

A flaw was found in Google Chrome on Android. A remote attacker, leveraging social engineering, could exploit a use-after-free vulnerability in the Sessions component. This flaw allows the attacker to execute arbitrary code outside the sandbox through user interface interaction, potentially leadi...

CVE-2026-79233

A flaw was found in CustomTabs in Google Chrome on Android. A remote attacker could exploit a user interface UI misrepresentation vulnerability by crafting a malicious HTML page. This could allow the attacker to spoof the address bar, potentially deceiving users about the authenticity of a websit...

CVE-2026-84333

A flaw was found in Dawn, a component of Google Chrome on Android. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution outside of the browser's sandbox, allowing the attacker to gain...

DroidSniper

DroidSniper - Misconfigured Android Debug Bridge Scanner 🎯 This tool, DroidSniper, is designed to detect misconfigured Android Debug Bridge ADB protocols on Android devices. These devices are vulnerable to unauthorized access via ADB due to misconfiguration. By scanning for ADB instances lacking...