CVE-2026-106716: Security vulnerability

Published Nov 5, 2026

Updated

ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload.

Event History

Nov 5, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:17 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs a user to open a crafted cmsvictor://open deep link that supplies an attacker-controlled activityUrl. The vulnerable WebView then loads that page with the Android and Offerwall JavaScript bridges exposed.

What information can a malicious page obtain?

The page can call getUserInfo, getCredentials, and initUser. This can expose user metadata and an encrypted credential payload.

How can I tell whether an app instance is affected?

The affected version identified in the available data is ReelShort for Android 3.8.55. An instance is exposed if it processes cmsvictor://open links whose activityUrl can be attacker-controlled and loads them without validating the page origin.

CVE-2026-106716: Security vulnerability

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information can a malicious page obtain?

How can I tell whether an app instance is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information can a malicious page obtain?

How can I tell whether an app instance is affected?