XSS in Pocket Browser Extension via Save to Pocket

Executive Summary

CVE-2026-82090 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Mozilla Pocket's Android and iOS apps. It allows malicious JavaScript to execute without user interaction by injecting unsanitized HTML via jQuery's .html() method. The flaw is triggered by a background service that fetches and renders malicious content automatically, making it a 0-click exploit.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the Pocket Android application (version 8.33.0.0) for the presence of the vulnerable `articleview-mobile.js` file and check if the `DownloadingService` automatically fetches and renders external HTML without user interaction. Review network traffic for unexpected data exfiltration attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript in the context of the Pocket app, potentially leading to data theft, session hijacking, or interaction with native app features via a JavaScript bridge. Since it is a 0-click exploit, users may be compromised without any action.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected Pocket versions may face compliance breaches and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Since Mozilla has declared Pocket out of scope and no patch is available, the only mitigation is to uninstall or disable the Pocket application entirely. Avoid using the service for future use due to the persistent risk.

Useful 0 Not Useful 0