The vulnerability identified as CVE-2026-78325 is a cross-site scripting issue in the Evernote and Google Keep note importers of Standard Notes for Android up to version 3.201.24. When a user imports a maliciously crafted .enex or Google Keep HTML file, arbitrary JavaScript can be executed in the app context. This can result in the compromise of sensitive data such as encryption keys and note contents, and may allow attackers to invoke native device APIs without authorization. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). No patch or remediation details are currently provided.

Successful exploitation of this vulnerability can lead to the theft of encryption keys and note data stored within the application. Additionally, attackers may invoke native device APIs arbitrarily, potentially leading to further compromise of the device or user data. The vulnerability requires user interaction (importing a crafted file) and local access (application context), limiting remote exploitation. The severity is assessed as medium based on the potential data theft and API invocation capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid importing .enex or Google Keep HTML files from untrusted sources. Monitoring vendor channels for updates and applying any forthcoming patches promptly is recommended.