CVE-2026-18312: XSS
Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or JavaScript context encoding, a crafted metadata value can break out of the intended URL structure and inject script content. An attacker could supply a document containing malicious metadata that, once synchronized to an Android device and rendered in the Reader WebView, results in execution of injected script content, enabling stored cross-site scripting (XSS)
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to trigger the issue?
The attacker needs to supply a document with crafted malicious metadata. The document must then be synchronized to an Android device running the application.
When would the injected script execute?
Execution occurs when the synchronized document is rendered in the Reader WebView on the Android device. The issue is stored XSS because the malicious metadata is retained in the document and later rendered.
Who is exposed to this issue?
Users of Readwise Reader for Android are exposed when they synchronize and render a document containing attacker-controlled malicious metadata.