Threats tagged 'ghsa-9jq9-g952-299j'

Joyland.ai contains a critical vulnerability (CVE-2026-102667) that allows an attacker with shared network access to inject JavaScript into WebView content. This can lead to unauthorized access to clipboard data, arbitrary HTTP requests, and app-internal storage. If the app has previously granted permissions, the attacker could access sensitive device features such as the file system, camera, microphone, and GPS tracking.