The vulnerability CVE-2026-21768 affects HCLSoftware Verse for Android, specifically version 14.5.10, due to improper input validation in the compose-rich-editor library version 1.0.0-rc14. This flaw allows malicious HTML content to be executed in certain situations during rich text email composition, potentially leading to high confidentiality and integrity impact. The CVSS 3.1 score is 6.3 (medium severity), with attack vector local, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No vendor advisory or patch information is currently provided.

Successful exploitation could allow an attacker to execute malicious HTML content within the email composition interface, potentially compromising confidentiality and integrity of user data. The vulnerability does not impact availability. The attack requires local access and user interaction, with high attack complexity, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling untrusted HTML content in email composition. No official remediation or temporary fixes have been published by the vendor at this time.