CVE-2026-18312

Deferred Deferred - Pending Action

Readwise Reader for Android Stored XSS via Untrusted URL Construction

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: CERT/CC

Description

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content, enabling stored cross-site scripting (XSS)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-18312

EUVD

EUVD-2026-87230

Affected Vendors & Products

Vendor	Product	Version / Range
readwise	reader	android

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves Readwise Reader for Android improperly handling URLs in its WebView. Attackers can inject malicious metadata that breaks out of the intended URL structure and executes script content in the WebView. This leads to stored cross-site scripting (XSS) attacks when the crafted document is rendered.

Detection Guidance

This vulnerability involves improper URL construction in Readwise Reader for Android using attacker-controlled metadata. Detection requires inspecting the app's handling of metadata and WebView rendering. Check if the app interpolates untrusted values into URLs without encoding. Review logs for suspicious metadata values or script execution in WebView.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute malicious scripts on your device when you view a crafted document in the Readwise Reader WebView. This may lead to unauthorized access to your data, session hijacking, or other malicious activities depending on the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate GDPR's data protection requirements or HIPAA's privacy and security rules. Organizations using Readwise Reader may face compliance risks if user data is compromised due to this XSS flaw.

Mitigation Strategies

Immediately update Readwise Reader for Android to the latest version if a patch is available. Disable WebView rendering for untrusted content or metadata. Implement input validation to sanitize metadata before URL construction. Use proper encoding for dynamic content inserted into URLs or DOM.

Hi! I’m here to help you understand CVE-2026-18312. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70