CVE-2026-18311: XSS
Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced devices when the malicious document is opened.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to control to exploit this issue?
The attacker needs to supply or cause the import of a document with malicious metadata, such as an attacker-controlled author meta tag. The malicious metadata is processed by the Android app and inserted into a WebView using innerHTML.
When does the malicious code execute?
The stored script executes when a synced Android device opens the malicious document. This means a document imported through one context can affect devices that later receive it through synchronization.