CVE-2026-87522

A flaw was found in WebView in Google Chrome on Android. Missing authorization allows a remote attacker, by leveraging social engineering and crafted network traffic, to potentially bypass system access restrictions. This could lead to unauthorized access to sensitive system functions...

CVE-2026-79273

A flaw was found in WebView in Google Chrome on Android. Incorrect reference resolution could allow a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions within the...

CVE-2026-79254

A flaw was found in Google Chrome on Android. Specifically, the CustomTabs feature suffers from incorrect reference resolution. A remote attacker could exploit this vulnerability by presenting a specially crafted HTML page, which could allow them to bypass system access restrictions...

EUVD-2026-86481

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

CVE-2026-84283

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities

Overview Three cross-site scripting XSS vulnerabilities identified in Readwise Reader for Android version 8.7.2 are disclosed. An attacker with the ability to craft malicious documents or metadata can exploit these vulnerabilities by supplying poisoned content that bypasses sanitization. Successf...

Context-Aware Functional Modeling for Android Third-Party Library Detection

Third-party libraries TPLs are widely used in Android apps, but their reuse can introduce security risks and interfere with downstream program analyses. Existing Android TPL detection approaches face two key limitations: their hand-crafted features are fragile under aggressive code transformation...

CVE-2026-100379: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...

CVE-2026-18312: Improper Neutralization of Input During Web Page Generation

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-18311: Improper Neutralization of Input During Web Page Generation

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18320: Improper Neutralization of Input During Web Page Generation

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

PT-2026-98896

Name of the Vulnerable Software and Affected Versions Readwise Reader for Android versions prior to 8.7.3 Description Stored cross-site scripting XSS occurs due to missing HTML sanitization when processing imported document metadata. Specifically, attacker-controlled fields such as doc.author and...

PT-2026-98898

🚨 CVE-2026-18320 Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could...

PT-2026-98897

🚨 CVE-2026-18312 Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs...

PT-2026-99123

Name of the Vulnerable Software and Affected Versions Wikimedia Foundation Wikipedia Android App affected versions not specified Description An issue exists that allows an unauthorized actor to access, intercept, or modify HTTP cookies, leading to the exposure of sensitive information...

CVE-2026-84283 FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

CVE-2026-84283

In FluteCode Secure Folder 1.2 , files designated for the password-protected vault are stored as unencrypted files within the Android shared-storage tree . This flaw allows a local application or file manager with access to the relevant shared-storage path to enumerate, copy, and open these files...

gt-7240r-root

GENESIS GT-7240R Root Tool This tool uses the CVE-2014-3153...

Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions

A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told h...

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories

This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more th...