ReelShort Android WebView JavaScript Bridge Exposure

Executive Summary

CVE-2026-106716 is a vulnerability in ReelShort for Android version 3.8.55 where the app loads attacker-controlled URLs in a WebView without validating the page origin. The app exposes sensitive JavaScript bridges that allow malicious pages to retrieve user metadata and encrypted credentials via methods like getUserInfo, getCredentials, and initUser.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect if ReelShort for Android version 3.8.55 is installed and check for deep-link handling of cmsvictor:// URLs. Review WebView configurations in the app for exposed JavaScript bridges and lack of origin validation. Use static analysis tools to examine exported activities and bridge installations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick you into opening a malicious link that exploits this flaw to steal your user data and encrypted credentials. The vulnerability allows unauthorized access to sensitive information without requiring additional authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by enabling unauthorized access to personal and sensitive user data. It could result in non-compliance due to insufficient security controls for protecting user information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately uninstall or update ReelShort to a patched version. If unavailable, restrict deep-link handling to allowlisted domains, enforce origin checks for JavaScript bridges, disable file access in WebView, and require user authorization for sensitive actions like credential access.

Useful 0 Not Useful 0