Search: CVE-2026-18312

CVE-2026-18312 is a stored cross-site scripting (XSS) vulnerability in Readwise Reader for Android versions 8.7.2 through 8.10.1. The app constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping, allowing malicious script injection via crafted metadata. This vulnerability enables execution of injected script content when the malicious document is synchronized and rendered in the Reader WebView.