CVE-2026-116072: Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Infinity for Reddit versions through 8.3.4 are affected. The issue involves the exported LoginChromeCustomTabActivity OAuth redirect handler.
Does exploitation require the attacker to have access to the victim's device or Reddit account?
No. The attacker can authorize the application's client ID using their own Reddit account and deliver a crafted infinity://localhost redirect. The victim must interact with that redirect.
What is the practical impact after a successful attack?
The application is logged into an account controlled by the attacker. The victim's posts, messages, and browsing activity in the app can then occur under that attacker-controlled account.