CVE-2026-73537 describes a cross-site scripting vulnerability in the Miraikan Assist App Android version. Exploitation of this flaw allows arbitrary script execution within the WebView component of the app, which can lead to altered content display. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS 3.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, limited integrity impact, and no availability impact.

Successful exploitation can result in the execution of arbitrary scripts in the app's WebView, potentially altering the content displayed to the user. There is no direct impact on confidentiality or availability, but integrity of displayed content can be compromised. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content within the app. Monitor official communications from the Japan Science and Technology Agency for updates.