CVE-2026-78325: XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Standard Notes for Android users running version 3.201.24 or earlier are exposed when they import an attacker-crafted Evernote .enex file or Google Keep HTML export.
What does an attacker need to exploit it?
The attacker needs to persuade a victim to import a crafted .enex file or Google Keep HTML file into the affected Android application. The described impact occurs in the application context after that import.
What could exploitation allow?
Successful exploitation can execute arbitrary JavaScript in the Standard Notes application context. This may allow theft of encryption keys and note data, as well as arbitrary invocation of native device APIs.
Is ordinary use affected without importing files?
The available information identifies the Evernote and Google Keep importers as the affected entry points. It does not indicate exploitation through ordinary note viewing or use without importing a crafted file.
What can be done before updating?
Do not import Evernote .enex or Google Keep HTML files from untrusted or unverifiable sources. Treat imported files as potentially malicious until the affected application is updated beyond the stated vulnerable versions.