Information Disclosure in FreeReels Android App

Executive Summary

CVE-2026-106713 is a vulnerability in FreeReels for Android version 2.3.11 where a remote attacker can exploit a deep link to load a malicious URL into a WebView without proper origin validation. The app's WebPageActivity component accepts externally controlled URLs and opens them in a WebView with a JavaScript bridge that exposes native handlers. This allows attackers to retrieve sensitive device information like IP addresses, device identifiers, cookies, and more.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the FreeReels Android app version 2.3.11 for deep link handling in WebPageActivity. Check if the app accepts external URLs in WebView without origin validation. Look for JavaScript bridge exposure (dwJsHandler) and intent: URL handling in JsBridge.openBrowser(). Use static analysis tools to review the app's manifest and decompiled code for these components.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to steal sensitive data from your device, such as your IP address, device identifier, cookies, and other information. It may also enable navigation to arbitrary Android intents, potentially leading to further malicious actions like unauthorized in-app purchases or account deletion if user interaction occurs.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the FreeReels app to a patched version if available. Restrict allowed URL schemes and hosts in WebPageActivity. Enforce origin checks for the JavaScript bridge and validate intent: URLs. Disable or restrict sensitive handlers in the bridge and apply stricter authorization for actions like data retrieval or in-app purchases.

Useful 0 Not Useful 0